{"id":"CVE-2026-115788","kind":"vulnerability","aliases":["CVE-2026-115788"],"related":[],"title":"IBM App Connect Operator and Certified Containers operands: log forging via resource creation request","description":"IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands is vulnerable to Log Forging on a request to create a resource.","summary":"IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands accept a request to create a resource that can inject forged entries into their logs. An attacker can use this to hide activity or plant misleading log lines.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM App Connect Operator","fixed":["13.7.0","12.0.29"],"affected":"CD 12.1.0 - 12.21.0; 12.0 LTS 12.0.0 - 12.0.28; 13 LTS 13.0.0 - 13.6.0","ecosystem":"vendor"},{"name":"IBM App Connect Enterprise Certified Containers Operands","fixed":["13.0.9.1-r1","12.0.12-r29"],"affected":"CD 12.0.11.1-r1 - 12.0.12.5-r1, 13.0.1.0-r1 - 13.0.6.2-r1; 12.0 LTS 12.0.12-r1 - 12.0.12-r28; 13 LTS 13.0.7.0-r1 - 13.0.9.0-r1","ecosystem":"vendor"}],"ecosystems":[],"tags":["ibm-app-connect","kubernetes","openshift","vendor"],"not_affected_if":["not-using-ibm-app-connect"],"how_to_check":"List the installed IBM App Connect Operator version (OpenShift: Installed Operators, or 'oc get csv -n <namespace>') and the operand image versions of your IntegrationServer/IntegrationRuntime resources. Exposed if the Operator is CD 12.1.0-12.21.0, 12.0 LTS 12.0.0-12.0.28, or 13 LTS 13.0.0-13.6.0, or operands are older than the fixed builds.","fix":"CD and 13 LTS: upgrade the IBM App Connect Operator to 13.7.0 or higher and all operands to 13.0.9.1-r1 or higher. 12.0 LTS: upgrade the Operator to 12.0.29 or higher and operands to 12.0.12-r29 or higher.","status":"open","published_at":"2026-11-13T22:17:21+00:00","first_seen_at":"2026-11-13T22:33:34+00:00","triaged_at":"2026-11-13T22:34:21+00:00","updated_at":"2026-11-13T22:37:49+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-13T22:34:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"IBM App Connect operator: log forging via resource creation requests","impact":"low","summary":"IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands accept a request to create a resource that can inject forged entries into their logs. An attacker can use this to hide activity or plant misleading log lines.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-app-connect","kubernetes","openshift"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker forges or hides entries in application logs","analyst_note":"Check IBM's security bulletin for affected and fixed versions and whether the request needs authentication; NVD entry has no product ranges.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-using-ibm-app-connect"],"who_is_affected":"Teams running IBM App Connect Operator or IBM App Connect Enterprise Certified Containers in Kubernetes or OpenShift clusters are the ones exposed. The sources do not say which versions or configurations are affected. Teams not running these IBM containers can skip it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000687,"input_tokens":4513,"output_tokens":472,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check IBM's security bulletin for affected and fixed versions and whether the request needs authentication; NVD entry has no product ranges.","search":"'-115788':17A,20A '-2026':16A,19A 'accept':51B 'activ':73B 'app':2A,22A,26A,34B,40B,45B,80C,85C 'attack':67B 'certifi':6A,48B,88C 'certified':29A 'connect':3A,23A,27A,35B,41B,46B,81C,86C 'contain':7A,49B,89C 'containers':30A 'creat':55B,100C 'creation':13A 'cve':15A,18A 'enterpris':47B,87C 'enterprise':28A 'entri':62B 'forg':10A,61B,95C 'hide':72B 'ibm':1A,21A,25A,33B,39B,44B,79C,84C 'ibm-app-connect':32B 'inject':60B 'kubernet':36B 'line':78B 'log':9A,65B,77B,94C 'mislead':76B 'openshift':37B 'oper':4A,42B,82C 'operand':8A,50B,90C 'operands':31A 'operator':24A 'plant':75B 'request':14A,53B,98C 'resourc':12A,57B,102C 'use':69B 'vendor':38B 'via':11A 'vulner':92C","nicknames":[],"mitigations":[],"who_affected":"Teams running the IBM App Connect Operator or IBM App Connect Enterprise Certified Containers operands on Kubernetes or OpenShift, in the versions IBM lists. The flaw is a log-forging bug (CWE-117) triggered by a request to create a resource; IBM rates it CVSS 8.1 with low privileges required over the network. Teams not running these IBM containers can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-13T22:37:49Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-app-connect-enterprise-certified-container-operator-and-operands-are-vulnerable-loss-confidentiality-and-denial-service-due-multiple-cves-6","run_id":3947},"products":{"at":"2026-11-13T22:37:49Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-app-connect-enterprise-certified-container-operator-and-operands-are-vulnerable-loss-confidentiality-and-denial-service-due-multiple-cves-6","run_id":3947},"who_affected":{"at":"2026-11-13T22:37:49Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-app-connect-enterprise-certified-container-operator-and-operands-are-vulnerable-loss-confidentiality-and-denial-service-due-multiple-cves-6","run_id":3947}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["appconnectenterprisecertifiedcontainersoperands","appconnectoperator","ibmappconnectenterprisecertifiedcontainersoperands","ibmappconnectoperator"],"ptokens":["app","certified","connect","containers","enterprise","ibm","operands","operator"],"labels":["high","ibmappconnect","kubernetes","openshift","vendor"],"campaign_type":null,"search_a":"'-115788':17A,20A '-2026':16A,19A 'app':2A,22A,26A 'certifi':6A 'certified':29A 'connect':3A,23A,27A 'contain':7A 'containers':30A 'creation':13A 'cve':15A,18A 'enterprise':28A 'forg':10A 'ibm':1A,21A,25A 'log':9A 'oper':4A 'operand':8A 'operands':31A 'operator':24A 'request':14A 'resourc':12A 'via':11A","search_b":"'accept':51B 'activ':73B 'app':34B,40B,45B 'attack':67B 'certifi':48B 'connect':35B,41B,46B 'contain':49B 'creat':55B 'enterpris':47B 'entri':62B 'forg':61B 'hide':72B 'ibm':33B,39B,44B 'ibm-app-connect':32B 'inject':60B 'kubernet':36B 'line':78B 'log':65B,77B 'mislead':76B 'openshift':37B 'oper':42B 'operand':50B 'plant':75B 'request':53B 'resourc':57B 'use':69B 'vendor':38B","search_c":"'app':80C,85C 'certifi':88C 'connect':81C,86C 'contain':89C 'creat':100C 'enterpris':87C 'forg':95C 'ibm':79C,84C 'log':94C 'oper':82C 'operand':90C 'request':98C 'resourc':102C 'vulner':92C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T22:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115788","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115788","severity":null,"published_at":"2026-11-13T22:17:21+00:00","modified_at":"2026-11-13T22:17:21+00:00","first_seen_at":"2026-11-13T22:33:34+00:00","fetched_at":"2026-11-13T22:33:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115788:3947","url":"https://www.ibm.com/support/pages/security-bulletin-ibm-app-connect-enterprise-certified-container-operator-and-operands-are-vulnerable-loss-confidentiality-and-denial-service-due-multiple-cves-6","severity":null,"published_at":"2026-11-13T22:37:49+00:00","modified_at":"2026-11-13T22:37:49+00:00","first_seen_at":"2026-11-13T22:37:49+00:00","fetched_at":"2026-11-13T22:37:49+00:00","note":"IBM bulletin (shared with many CVEs) lists affected/fixed versions; says no workarounds. Not exploited, no PoC found. Bulletin page truncated in web-cli; version lists read via WebFetch, same as IBM's UBI bulletin. Auth requirement per CVSS PR:L only.","cites":["https://www.ibm.com/support/pages/security-bulletin-ibm-app-connect-enterprise-certified-container-operator-and-operands-are-vulnerable-loss-confidentiality-and-denial-service-due-multiple-cves-6"]}],"documents":[{"id":150675,"url":"https://www.ibm.com/support/pages/security-bulletin-ibm-app-connect-enterprise-certified-container-operator-and-operands-are-vulnerable-loss-confidentiality-and-denial-service-due-multiple-cves-6","title":"IBM Security Bulletin: App Connect Enterprise Certified Container operator and operands (multiple CVEs)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}