CVE-2026-109158

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-109158", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-10-12T12:02:17.685Z", "datePublished": "2026-11-13T22:03:01.617Z", "dateUpdated": "2026-11-13T22:03:27.115Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-11-13T22:03:27.115Z"}, "title": "IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands Insertion of Sensitive Information into Log File", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-532", "description": "CWE-532 Insertion of Sensitive Information into Log File", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "App Connect Operator", "versions": [{"status": "affected", "version": "12.1.0", "lessThanOrEqual": "12.21.0", "versionType": "semver"}, {"status": "affected", "version": "12.0.0", "lessThanOrEqual": "12.0.28", "versionType": "semver"}, {"status": "affected", "version": "13.0.0", "lessThanOrEqual": "13.6.0", "versionType": "semver"}], "cpes": ["cpe:2.3:a:ibm:app_connect_operator:12.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:app_connect_operator:12.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:app_connect_operator:13.0.0:*:*:*:*:*:*:*"]}, {"vendor": "IBM", "product": "App Connect Enterprise Certified Containers Operands", "versions": [{"status": "affected", "version": "12.0.11.1-r1", "lessThanOrEqual": "12.0.12.5-r1", "versionType": "custom"}, {"status": "affected", "version": "13.0.1.0-r1", "lessThanOrEqual": "13.0.6.2-r1", "versionType": "custom"}, {"status": "affected", "version": "12.0.12-r1", "lessThanOrEqual": "12.0.12-r28", "versionType": "custom"}, {"status": "affected", "version": "13.0.7.0-r1", "lessThanOrEqual": "13.0.9.0-r1", "versionType": "custom"}], "cpes": ["cpe:2.3:a:ibm:app_connect_enterprise_certified_containers_operands:cd:12.0.11.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:app_connect_enterprise_certified_containers_operands:cd:13.0.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:app_connect_enterprise_certified_containers_operands:cd:12.0.12:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:app_connect_enterprise_certified_containers_operands:cd:13.0.7.0:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands may allow the AI Agent to log sensitive information about the deployed environment within error messages.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands may allow the AI Agent to log sensitive information about the deployed environment within error messages.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7296008", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "solutions": [{"lang": "en", "value": "IBM strongly suggests the following:\n\n\n\nApp Connect Enterprise Certified Container CD and 13 LTS (Long Term Support)\n\n\n\nUpgrade to App Connect Enterprise Certified Container Operator version 13.7.0 or higher, and ensure that all components are at 13.0.9.1-r1 or higher. \u00a0Documentation on the upgrade process is available at https://www.ibm.com/docs/en/app-connect/13.0?topic=releases-upgrading-operator \n\n\n\n\nApp Connect Enterprise Certified Container 12.0 LTS (Long Term Support)\n\n\n\nUpgrade to App Connect Enterprise Certified Container Operator version 12.0.29 or higher, and ensure that all components are at 12.0.12-r29 or higher. \u00a0Documentation on the upgrade process is available at https://www.ibm.com/docs/en/app-connect/12.0?topic=umfpr-upgrading-operator-releases", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM strongly suggests the following:</p><p><strong>App Connect Enterprise Certified Container CD and 13 LTS (Long Term Support)</strong></p><p>Upgrade to App Connect Enterprise Certified Container Operator version 13.7.0 or higher, and ensure that all components are at 13.0.9.1-r1 or higher. \u00a0Documentation on the upgrade process is available at <a href=\"https://www.ibm.com/docs/en/app-connect/13.0?topic=releases-upgrading-operator\" rel=\"nofollow\">https://www.ibm.com/docs/en/app-connect/13.0?topic=releases-upgrading-operator</a></p><p><br/><strong>App Connect Enterprise Certified Container 12.0 LTS (Long Term Support)</strong></p><p>Upgrade to App Connect Enterprise Certified Container Operator version 12.0.29 or higher, and ensure that all components are at 12.0.12-r29 or higher. \u00a0Documentation on the upgrade process is available at <a href=\"https://www.ibm.com/docs/en/app-connect/12.0?topic=umfpr-upgrading-operator-releases\" rel=\"nofollow\">https://www.ibm.com/docs/en/app-connect/12.0?topic=umfpr-upgrading-operator-releases</a></p>"}]}]}}}

{}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:app_connect_operator:12.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:app_connect_operator:12.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:app_connect_operator:13.0.0:*:*:*:*:*:*:*"], "product": "App Connect Operator", "vendor": "IBM", "versions": [{"lessThanOrEqual": "12.21.0", "status": "affected", "version": "12.1.0", "versionType": "semver"}, {"lessThanOrEqual": "12.0.28", "status": "affected", "version": "12.0.0", "versionType": "semver"}, {"lessThanOrEqual": "13.6.0", "status": "affected", "version": "13.0.0", "versionType": "semver"}]}, {"cpes": ["cpe:2.3:a:ibm:app_connect_enterprise_certified_containers_operands:cd:12.0.11.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:app_connect_enterprise_certified_containers_operands:cd:13.0.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:app_connect_enterprise_certified_containers_operands:cd:12.0.12:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:app_connect_enterprise_certified_containers_operands:cd:13.0.7.0:*:*:*:*:*:*:*"], "product": "App Connect Enterprise Certified Containers Operands", "vendor": "IBM", "versions": [{"lessThanOrEqual": "12.0.12.5-r1", "status": "affected", "version": "12.0.11.1-r1", "versionType": "custom"}, {"lessThanOrEqual": "13.0.6.2-r1", "status": "affected", "version": "13.0.1.0-r1", "versionType": "custom"}, {"lessThanOrEqual": "12.0.12-r28", "status": "affected", "version": "12.0.12-r1", "versionType": "custom"}, {"lessThanOrEqual": "13.0.9.0-r1", "status": "affected", "version": "13.0.7.0-r1", "versionType": "custom"}]}], "source": "psirt@us.ibm.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands may allow the AI Agent to log sensitive information about the deployed environment within error messages."}], "id": "CVE-2026-109158", "lastModified": "2026-11-13T22:17:20.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "psirt@us.ibm.com", "type": "Primary"}]}, "published": "2026-11-13T22:17:20.060", "references": [{"source": "psirt@us.ibm.com", "url": "https://www.ibm.com/support/pages/node/7296008"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-532"}], "source": "psirt@us.ibm.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[12.0.11.1-r1,12.0.12.5-r1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[13.0.1.0-r1,13.0.6.2-r1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[12.0.12-r1,12.0.12-r28]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[13.0.7.0-r1,13.0.9.0-r1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "App Connect Enterprise Certified Containers Operands", "source": "cna", "vendor": "IBM"}, "product": "app_connect_enterprise_certified_containers_operands", "vendor": "ibm"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.1.0,12.21.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.0.0,12.0.28]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.0.0,13.6.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "App Connect Operator", "source": "cna", "vendor": "IBM"}, "product": "app_connect_operator", "vendor": "ibm"}], "created": "2026-11-14T00:00:13.209151+00:00", "updated": "2026-11-14T00:00:13.209172+00:00", "vendors": ["ibm", "ibm$PRODUCT$app_connect_enterprise_certified_containers_operands", "ibm$PRODUCT$app_connect_operator"]}