---
id: "CVE-2026-109158"
page: "https://infrastack.ai/live/CVE-2026-109158"
kind: "vulnerability"
aliases: ["CVE-2026-109158"]
title: "IBM App Connect: AI Agent may log sensitive environment details in errors"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "IBM App Connect Operator", "fixed": ["13.7.0", "12.0.29"], "affected": "unknown, see IBM bulletin table", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["ai-agent", "ibm-app-connect", "kubernetes", "vendor"]
not_affected_if: ["no-ai-agent", "no-app-connect-containers"]
published_at: "2026-11-13T22:17:20+00:00"
first_seen_at: "2026-11-13T22:33:33+00:00"
updated_at: "2026-11-13T22:38:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109158", "first_seen_at": "2026-11-13T22:33:33+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/security-bulletin-ibm-app-connect-enterprise-certified-container-operator-and-operands-are-vulnerable-loss-confidentiality-and-denial-service-due-multiple-cves-6", "first_seen_at": "2026-11-13T22:38:48+00:00", "cites": ["https://www.ibm.com/support/pages/security-bulletin-ibm-app-connect-enterprise-certified-container-operator-and-operands-are-vulnerable-loss-confidentiality-and-denial-service-due-multiple-cves-6"]}]
exploit_sources: []
---

# IBM App Connect: AI Agent may log sensitive environment details in errors

Link for people: https://infrastack.ai/live/CVE-2026-109158 (this .md is for agents)

IBM App Connect Operator and App Connect Enterprise Certified Containers can let the AI Agent write sensitive information about the deployed environment into error messages. An attacker who can read those error messages or logs can learn details about the deployment.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:IBM App Connect Operator affected unknown, see IBM bulletin table fixed 13.7.0, 12.0.29

## How to check

- Check the installed IBM App Connect Operator version (e.g. oc get csv -A | grep -i appconnect) and the operand versions of your IntegrationDashboard/IntegrationServer resources against the fixed versions.
- Check whether the AI Agent in the App Connect Enterprise Dashboard is in use, and who can read the Dashboard container logs and error output.

## Fix

CD and 13 LTS: upgrade App Connect Enterprise Certified Container Operator to 13.7.0 or higher, with all components at 13.0.9.1-r1 or later. 12.0 LTS: Operator 12.0.29 or later, components 12.0.12-r29 or later. IBM lists no workarounds.

## Timeline

- 2026-11-13T22:33:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109158
- 2026-11-13T22:38:48+00:00 analyst https://www.ibm.com/support/pages/security-bulletin-ibm-app-connect-enterprise-certified-container-operator-and-operands-are-vulnerable-loss-confidentiality-and-denial-service-due-multiple-cves-6 — Read IBM multi-CVE bulletin (via fetch, long page): CVE-2026-109158 = AI Agent in App Connect Enterprise Dashboard may log sensitive info (CWE-532, CVSS 7.5). Fix: Operator 13.7.0+ with components 13.0.9.1-r1+ (CD and 13 LTS); 12.0 LTS: Operator 12.0.29+, components 12.0.12-r29+. No workarounds. Exact affected ranges per track not read; no exploitation, no posts searched.

## Documents

- [advisory] IBM Security Bulletin: App Connect Enterprise Certified Container operator and operands (multiple CVEs) https://www.ibm.com/support/pages/security-bulletin-ibm-app-connect-enterprise-certified-container-operator-and-operands-are-vulnerable-loss-confidentiality-and-denial-service-due-multiple-cves-6

## From the sources

IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands may allow the AI Agent to log sensitive information about the deployed environment within error messages.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_