IBM APP CONNECT OPERATOR · CVE-2026-115788 · Vendor
FIX → 13.7.0 · 12.0.29 · 13.0.9.1-r1 · 12.0.12-r29 ✓ verified
IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands accept a request to create a resource that can inject forged entries into their logs. An attacker can use this to hide activity or plant misleading log lines.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running the IBM App Connect Operator or IBM App Connect Enterprise Certified Containers operands on Kubernetes or OpenShift, in the versions IBM lists. The flaw is a log-forging bug (CWE-117) triggered by a request to create a resource; IBM rates it CVSS 8.1 with low privileges required over the network. Teams not running these IBM containers can skip it.
Not affected if not-using-ibm-app-connect
Who cares ibm-app-connect, kubernetes, openshift
oc get csv -n <namespace>) and the operand image versions of your IntegrationServer/IntegrationRuntime resources12.1.0-12.21.0, 12.0 LTS 12.0.0-12.0.28, or 13 LTS , or operands are older than the fixed buildsIBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands is vulnerable to Log Forging on a request to create a resource.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
13.0.0-13.6.0Upgrade to 13.7.0 · 12.0.29 · 13.0.9.1-r1 · 12.0.12-r29
CD and 13 LTS: upgrade the IBM App Connect Operator to 13.7.0 or higher and all operands to 13.0.9.1-r1 or higher. 12.0 LTS: upgrade the Operator to 12.0.29 or higher and operands to 12.0.12-r29 or higher.