CVE-2026-84274: IBM Guardium Data Protection Information Disclosure
IBM Guardium Data Protection 12.2.2 is affected by a sensitive information exposure vulnerability. During SECRET and APIKEY rotation processing, sensitive credential material is logged at INFO level by the edge-controller/edge-manager components. An authenticated attacker with access to the relevant application or container logs could obtain these credentials and use them to impersonate services or gain unauthorized access to the Guardium control plane.
Other sources
IBM Security Guardium Data Protection is affected by a sensitive information exposure vulnerability. During SECRET and APIKEY rotation processing, sensitive credential material is logged at INFO level by the edge-controller/edge-manager components. An authenticated attacker with access to the relevant application or container logs could obtain these credentials and use them to impersonate services or gain unauthorized access to the Guardium control plane.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Guardium Data Protectionto a version that resolves this vulnerability.Fixed in 12.2.3Patch SqlGuard_12.0p15004_Edge
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Deployments of IBM Guardium Data Protection 12.2.2 are exposed when SECRET or API_KEY rotation occurs and authenticated users can access the relevant edge-controller or edge-manager application or container logs.
What does an attacker need to exploit it?
An attacker needs authenticated access to the relevant logs. No additional user interaction is required; the attacker can retrieve credential material written at INFO level during rotation processing.
What could an attacker do with the exposed credentials?
The disclosed credentials may allow the attacker to impersonate services or obtain unauthorized access to the Guardium control plane.
How can I determine whether credentials may already have been exposed?
Review edge-controller and edge-manager application or container logs generated during SECRET and API_KEY rotation events. Sensitive credential material logged at INFO level during those events indicates potential exposure.