CVE-2026-84274: IBM Guardium Data Protection Information Disclosure

Q: Who is realistically exposed to this issue?

Deployments of IBM Guardium Data Protection 12.2.2 are exposed when SECRET or API_KEY rotation occurs and authenticated users can access the relevant edge-controller or edge-manager application or container logs.

Q: What does an attacker need to exploit it?

An attacker needs authenticated access to the relevant logs. No additional user interaction is required; the attacker can retrieve credential material written at INFO level during rotation processing.

Q: What could an attacker do with the exposed credentials?

The disclosed credentials may allow the attacker to impersonate services or obtain unauthorized access to the Guardium control plane.

Q: How can I determine whether credentials may already have been exposed?

Review edge-controller and edge-manager application or container logs generated during SECRET and API_KEY rotation events. Sensitive credential material logged at INFO level during those events indicates potential exposure.

Published Sep 21, 2026

Updated

IBM Guardium Data Protection 12.2.2 is affected by a sensitive information exposure vulnerability. During SECRET and APIKEY rotation processing, sensitive credential material is logged at INFO level by the edge-controller/edge-manager components. An authenticated attacker with access to the relevant application or container logs could obtain these credentials and use them to impersonate services or gain unauthorized access to the Guardium control plane.

Other sources

IBM Security Guardium Data Protection is affected by a sensitive information exposure vulnerability. During SECRET and APIKEY rotation processing, sensitive credential material is logged at INFO level by the edge-controller/edge-manager components. An authenticated attacker with access to the relevant application or container logs could obtain these credentials and use them to impersonate services or gain unauthorized access to the Guardium control plane.

— IBM

Affected Software

2 affected components

IBM Guardium Data Protection<=12.2.2

IBM Guardium Data Protection=12.2.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM Guardium Data Protection to a version that resolves this vulnerability.
Fixed in 12.2.3Patch SqlGuard_12.0p15004_Edge

Event History

Sep 21, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Oct 8, 2026

CVE Published

via MITRE·07:04 PM

Data Sourced

via MITRE·07:04 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

IBM-7288627

Frequently Asked Questions

Who is realistically exposed to this issue?

Deployments of IBM Guardium Data Protection 12.2.2 are exposed when SECRET or API_KEY rotation occurs and authenticated users can access the relevant edge-controller or edge-manager application or container logs.

What does an attacker need to exploit it?

An attacker needs authenticated access to the relevant logs. No additional user interaction is required; the attacker can retrieve credential material written at INFO level during rotation processing.

What could an attacker do with the exposed credentials?

The disclosed credentials may allow the attacker to impersonate services or obtain unauthorized access to the Guardium control plane.

How can I determine whether credentials may already have been exposed?

Review edge-controller and edge-manager application or container logs generated during SECRET and API_KEY rotation events. Sensitive credential material logged at INFO level during those events indicates potential exposure.

CVE-2026-84274: IBM Guardium Data Protection Information Disclosure

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit it?

What could an attacker do with the exposed credentials?

How can I determine whether credentials may already have been exposed?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit it?

What could an attacker do with the exposed credentials?

How can I determine whether credentials may already have been exposed?