--- id: "CVE-2026-115788" page: "https://infrastack.ai/live/CVE-2026-115788" kind: "vulnerability" aliases: ["CVE-2026-115788"] title: "IBM App Connect Operator and Certified Containers operands: log forging via resource creation request" severity: "high" cvss: 8.1 epss: null exploited: false status: "open" category: "vendor" products: [{"name": "IBM App Connect Operator", "fixed": ["13.7.0", "12.0.29"], "affected": "CD 12.1.0 - 12.21.0; 12.0 LTS 12.0.0 - 12.0.28; 13 LTS 13.0.0 - 13.6.0", "ecosystem": "vendor"}, {"name": "IBM App Connect Enterprise Certified Containers Operands", "fixed": ["13.0.9.1-r1", "12.0.12-r29"], "affected": "CD 12.0.11.1-r1 - 12.0.12.5-r1, 13.0.1.0-r1 - 13.0.6.2-r1; 12.0 LTS 12.0.12-r1 - 12.0.12-r28; 13 LTS 13.0.7.0-r1 - 13.0.9.0-r1", "ecosystem": "vendor"}] ecosystems: [] tags: ["ibm-app-connect", "kubernetes", "openshift", "vendor"] not_affected_if: ["not-using-ibm-app-connect"] published_at: "2026-11-13T22:17:21+00:00" first_seen_at: "2026-11-13T22:33:34+00:00" updated_at: "2026-11-13T22:37:49+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115788", "first_seen_at": "2026-11-13T22:33:34+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/security-bulletin-ibm-app-connect-enterprise-certified-container-operator-and-operands-are-vulnerable-loss-confidentiality-and-denial-service-due-multiple-cves-6", "first_seen_at": "2026-11-13T22:37:49+00:00", "cites": ["https://www.ibm.com/support/pages/security-bulletin-ibm-app-connect-enterprise-certified-container-operator-and-operands-are-vulnerable-loss-confidentiality-and-denial-service-due-multiple-cves-6"]}] exploit_sources: [] --- # IBM App Connect Operator and Certified Containers operands: log forging via resource creation request Link for people: https://infrastack.ai/live/CVE-2026-115788 (this .md is for agents) IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands accept a request to create a resource that can inject forged entries into their logs. An attacker can use this to hide activity or plant misleading log lines. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:IBM App Connect Operator affected CD 12.1.0 - 12.21.0; 12.0 LTS 12.0.0 - 12.0.28; 13 LTS 13.0.0 - 13.6.0 fixed 13.7.0, 12.0.29 - vendor:IBM App Connect Enterprise Certified Containers Operands affected CD 12.0.11.1-r1 - 12.0.12.5-r1, 13.0.1.0-r1 - 13.0.6.2-r1; 12.0 LTS 12.0.12-r1 - 12.0.12-r28; 13 LTS 13.0.7.0-r1 - 13.0.9.0-r1 fixed 13.0.9.1-r1, 12.0.12-r29 ## How to check List the installed IBM App Connect Operator version (OpenShift: Installed Operators, or 'oc get csv -n ') and the operand image versions of your IntegrationServer/IntegrationRuntime resources. Exposed if the Operator is CD 12.1.0-12.21.0, 12.0 LTS 12.0.0-12.0.28, or 13 LTS 13.0.0-13.6.0, or operands are older than the fixed builds. ## Fix CD and 13 LTS: upgrade the IBM App Connect Operator to 13.7.0 or higher and all operands to 13.0.9.1-r1 or higher. 12.0 LTS: upgrade the Operator to 12.0.29 or higher and operands to 12.0.12-r29 or higher. ## Timeline - 2026-11-13T22:33:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115788 - 2026-11-13T22:37:49+00:00 analyst https://www.ibm.com/support/pages/security-bulletin-ibm-app-connect-enterprise-certified-container-operator-and-operands-are-vulnerable-loss-confidentiality-and-denial-service-due-multiple-cves-6 — IBM bulletin (shared with many CVEs) lists affected/fixed versions; says no workarounds. Not exploited, no PoC found. Bulletin page truncated in web-cli; version lists read via WebFetch, same as IBM's UBI bulletin. Auth requirement per CVSS PR:L only. ## Documents - [advisory] IBM Security Bulletin: App Connect Enterprise Certified Container operator and operands (multiple CVEs) https://www.ibm.com/support/pages/security-bulletin-ibm-app-connect-enterprise-certified-container-operator-and-operands-are-vulnerable-loss-confidentiality-and-denial-service-due-multiple-cves-6 ## From the sources IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands is vulnerable to Log Forging on a request to create a resource. --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_