CVE-2026-109158: IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands Insertion of Sensitive Information into Log File

Published Nov 13, 2026

Updated

IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands may allow the AI Agent to log sensitive information about the deployed environment within error messages.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade App Connect Enterprise Certified Container Operator to a version that resolves this vulnerability.
Fixed in 12.0.29
Upgrade
Upgrade App Connect Enterprise Certified Container components to a version that resolves this vulnerability.
Fixed in 12.0.12-r29
Upgrade
Upgrade App Connect Enterprise Certified Container Operator to a version that resolves this vulnerability.
Fixed in 13.7.0
Upgrade
Upgrade App Connect Enterprise Certified Container components to a version that resolves this vulnerability.
Fixed in 13.0.9.1-r1

Event History

Nov 13, 2026

CVE Published

via MITRE·10:03 PM

Data Sourced

via MITRE·10:03 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What component creates the exposure?

The exposure occurs when the AI Agent logs error messages that include sensitive information about the deployed environment.

Can an unauthenticated remote attacker trigger this issue?

The provided vector lists network access, low attack complexity, no privileges required, and no user interaction. However, the data does not specify the request or condition an attacker would use to cause the relevant error messages.

What is the likely impact if the issue is exploited?

The supplied severity vector indicates high confidentiality impact, with no integrity or availability impact. The risk is disclosure of sensitive deployed-environment information through logs.

CVE-2026-109158: IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands Insertion of Sensitive Information into Log File

Remediation

Event History

Frequently Asked Questions

What component creates the exposure?

Can an unauthenticated remote attacker trigger this issue?

What is the likely impact if the issue is exploited?

Company

Resources

Contact

Frequently Asked Questions

What component creates the exposure?

Can an unauthenticated remote attacker trigger this issue?

What is the likely impact if the issue is exploited?