IBM ASPERA CONNECT · CVE-2026-120113 · Other
NO FIX YET
IBM Aspera Connect's local HTTP service has no authentication and permissive cross-origin rules, so a web page a victim visits can read and modify its configuration, including host trust settings. An attacker gets sensitive information and can change which hosts the client trusts.
first public Nov 8, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Machines where IBM Aspera Connect in the affected range is installed and its local HTTP service is running, since a malicious web page in the user's browser can reach it. The sources do not say which configurations are exposed beyond the affected version range. unknown
Not affected if unknown
Who cares ibm-aspera-connect, linux, macos, windows
No fix yet, per the sources.
IBM Aspera Connect 1.6.1 through 4.2.19 could allow a remote attacker to obtain sensitive information and modify host trust configuration due to missing authentication and overly permissive cross-origin access controls in the local HTTP service. By persuading a victim to visit a malicious web page, an attacker could perform unauthorized cross-origin requests to read and modify configuration.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.