{"id":"CVE-2026-114468","kind":"vulnerability","aliases":["CVE-2026-114468"],"related":[],"title":"IBM App Connect Operator: attacker in container can make admin calls","description":"IBM App Connect Operator and App Connect Enterprise Certified Containers Operands could allow an attacker with the ability to run HTTP calls within the running container to can make administrative calls to a running IntegrationRuntime.","summary":"IBM App Connect Operator and App Connect Enterprise Certified Containers Operands can let an attacker who can make HTTP calls inside a running container make administrative calls to a running IntegrationRuntime. The sources do not describe the full impact beyond that.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-app-connect","kubernetes","openshift","vendor"],"not_affected_if":["no-app-connect-operator"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-13T22:17:21+00:00","first_seen_at":"2026-11-13T22:33:34+00:00","triaged_at":"2026-11-13T22:34:37+00:00","updated_at":"2026-11-13T22:34:37+00:00","category":"vendor","confidence":0.45,"triage":{"at":"2026-11-13T22:34:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"IBM App Connect Operator: attacker in container can make admin calls","impact":"medium","summary":"IBM App Connect Operator and App Connect Enterprise Certified Containers Operands can let an attacker who can make HTTP calls inside a running container make administrative calls to a running IntegrationRuntime. The sources do not describe the full impact beyond that.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-app-connect","kubernetes","openshift"],"confidence":0.45,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker makes administrative calls to a running IntegrationRuntime","analyst_note":"Find IBM's security bulletin for CVE-2026-114468 to get affected versions, fixed versions and any configuration workaround; the NVD entry alone gives none.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-app-connect-operator"],"who_is_affected":"Teams running IBM App Connect Enterprise Certified Containers in Kubernetes or OpenShift with the App Connect Operator. The exposure needs an attacker who can already run HTTP calls from within a running container, so the risk is mainly to shared or multi-tenant clusters. The sources do not give affected version ranges.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000708,"input_tokens":4528,"output_tokens":511,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114468':14A,17A '-2026':13A,16A 'abil':82C 'admin':10A 'administr':50B,94C 'allow':77C 'app':2A,20B,26B,30B,66C,70C 'attack':5A,39B,79C 'beyond':64B 'call':11A,44B,51B,86C,95C 'certifi':33B,73C 'connect':3A,21B,27B,31B,67C,71C 'contain':7A,34B,48B,74C,90C 'could':76C 'cve':12A,15A 'describ':60B 'enterpris':32B,72C 'full':62B 'http':43B,85C 'ibm':1A,19B,25B,65C 'ibm-app-connect':18B 'impact':63B 'insid':45B 'integrationruntim':55B,99C 'kubernet':22B 'let':37B 'make':9A,42B,49B,93C 'openshift':23B 'oper':4A,28B,68C 'operand':35B,75C 'run':47B,54B,84C,89C,98C 'sourc':57B 'vendor':24B 'within':87C","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM App Connect Enterprise Certified Containers in Kubernetes or OpenShift with the App Connect Operator. The exposure needs an attacker who can already run HTTP calls from within a running container, so the risk is mainly to shared or multi-tenant clusters. The sources do not give affected version ranges.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ibmappconnect","kubernetes","medium","openshift","vendor"],"campaign_type":null,"search_a":"'-114468':14A,17A '-2026':13A,16A 'admin':10A 'app':2A 'attack':5A 'call':11A 'connect':3A 'contain':7A 'cve':12A,15A 'ibm':1A 'make':9A 'oper':4A","search_b":"'administr':50B 'app':20B,26B,30B 'attack':39B 'beyond':64B 'call':44B,51B 'certifi':33B 'connect':21B,27B,31B 'contain':34B,48B 'describ':60B 'enterpris':32B 'full':62B 'http':43B 'ibm':19B,25B 'ibm-app-connect':18B 'impact':63B 'insid':45B 'integrationruntim':55B 'kubernet':22B 'let':37B 'make':42B,49B 'openshift':23B 'oper':28B 'operand':35B 'run':47B,54B 'sourc':57B 'vendor':24B","search_c":"'abil':82C 'administr':94C 'allow':77C 'app':66C,70C 'attack':79C 'call':86C,95C 'certifi':73C 'connect':67C,71C 'contain':74C,90C 'could':76C 'enterpris':72C 'http':85C 'ibm':65C 'integrationruntim':99C 'make':93C 'oper':68C 'operand':75C 'run':84C,89C,98C 'within':87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T22:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114468","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114468","severity":null,"published_at":"2026-11-13T22:17:21+00:00","modified_at":"2026-11-13T22:17:21+00:00","first_seen_at":"2026-11-13T22:33:34+00:00","fetched_at":"2026-11-13T22:33:34+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}