IBM APP CONNECT OPERATOR · CVE-2026-109158 · Vendor
FIX → 13.7.0 · 12.0.29 ✓ verified
IBM App Connect Operator and App Connect Enterprise Certified Containers can let the AI Agent write sensitive information about the deployed environment into error messages. An attacker who can read those error messages or logs can learn details about the deployment.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running IBM App Connect Enterprise Certified Containers (Operator and operands, Continuous Delivery, 12.0 LTS or 13 LTS tracks) where the Dashboard's AI Agent can write sensitive environment details into error messages and logs. Exposure depends on who can read those errors and logs. Teams not running App Connect on Kubernetes or not using the AI Agent can skip it.
Not affected if no-ai-agent, no-app-connect-containers
Who cares ai-agent, ibm-app-connect, kubernetes
Upgrade to 13.7.0 · 12.0.29
13.7.0 or higher, with all components at or later. 12.0 LTS: Operator or later, components or laterIBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands may allow the AI Agent to log sensitive information about the deployed environment within error messages.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
13.0.9.1-r112.0.2912.0.12-r29