{"id":"CVE-2026-120113","kind":"vulnerability","aliases":["CVE-2026-120113"],"related":[],"title":"IBM Aspera Connect: local web service lets malicious pages read and change settings","description":"IBM Aspera Connect 1.6.1 through 4.2.19 could allow a remote attacker to obtain sensitive information and modify host trust configuration due to missing authentication and overly permissive cross-origin access controls in the local HTTP service. By persuading a victim to visit a malicious web page, an attacker could perform unauthorized cross-origin requests to read and modify configuration.","summary":"IBM Aspera Connect's local HTTP service has no authentication and permissive cross-origin rules, so a web page a victim visits can read and modify its configuration, including host trust settings. An attacker gets sensitive information and can change which hosts the client trusts.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM Aspera Connect","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ibm-aspera-connect","linux","macos","other","windows"],"not_affected_if":["unknown"],"how_to_check":"- Check whether IBM Aspera Connect is installed and its version, from the Aspera Connect application or its installation folder.\n- Confirm whether the version falls in 1.6.1 through 4.2.19.","fix":null,"status":"open","published_at":"2026-11-08T18:17:00+00:00","first_seen_at":"2026-11-08T18:22:21+00:00","triaged_at":"2026-11-08T18:22:48+00:00","updated_at":"2026-11-08T18:22:48+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-08T18:22:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"IBM Aspera Connect: local web service lets malicious pages read and change settings","impact":"medium","summary":"IBM Aspera Connect's local HTTP service has no authentication and permissive cross-origin rules, so a web page a victim visits can read and modify its configuration, including host trust settings. An attacker gets sensitive information and can change which hosts the client trusts.","audience":"businesses","category":"other","nicknames":[],"who_cares":["ibm-aspera-connect","windows","macos","linux"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reads settings and changes which hosts the client trusts","analyst_note":"Confirm the fixed version and any vendor advisory for IBM Aspera Connect; the sources give only the affected range 1.6.1 through 4.2.19.","how_to_check":"- Check whether IBM Aspera Connect is installed and its version, from the Aspera Connect application or its installation folder.\n- Confirm whether the version falls in 1.6.1 through 4.2.19.","plain_action":"","product_name":"IBM Aspera Connect","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Machines where IBM Aspera Connect in the affected range is installed and its local HTTP service is running, since a malicious web page in the user's browser can reach it. The sources do not say which configurations are exposed beyond the affected version range. unknown","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000743,"input_tokens":4590,"output_tokens":567,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120113':16A,19A '-2026':15A,18A '1.6.1':80C '4.2.19':82C 'access':107C 'allow':84C 'aspera':2A,21A,25B,32B,78C 'attack':65B,87C,125C 'authent':40B,100C 'chang':12A,71B 'client':75B 'configur':59B,96C,137C 'connect':3A,22A,26B,33B,79C 'control':108C 'could':83C,126C 'cross':44B,105C,130C 'cross-origin':43B,104C,129C 'cve':14A,17A 'due':97C 'get':66B 'host':61B,73B,94C 'http':36B,112C 'ibm':1A,20A,24B,31B,77C 'ibm-aspera-connect':23B 'includ':60B 'inform':68B,91C 'let':7A 'linux':27B 'local':4A,35B,111C 'maco':28B 'malici':8A,121C 'miss':99C 'modifi':57B,93C,136C 'obtain':89C 'origin':45B,106C,131C 'over':102C 'page':9A,50B,123C 'perform':127C 'permiss':42B,103C 'persuad':115C 'read':10A,55B,134C 'remot':86C 'request':132C 'rule':46B 'sensit':67B,90C 'servic':6A,37B,113C 'set':13A,63B 'trust':62B,76B,95C 'unauthor':128C 'victim':52B,117C 'visit':53B,119C 'web':5A,49B,122C 'window':30B","nicknames":[],"mitigations":[],"who_affected":"Machines where IBM Aspera Connect in the affected range is installed and its local HTTP service is running, since a malicious web page in the user's browser can reach it. The sources do not say which configurations are exposed beyond the affected version range. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["asperaconnect","ibmasperaconnect"],"ptokens":["aspera","connect","ibm"],"labels":["ibmasperaconnect","linux","macos","medium","other","vendor","windows"],"campaign_type":null,"search_a":"'-120113':16A,19A '-2026':15A,18A 'aspera':2A,21A 'chang':12A 'connect':3A,22A 'cve':14A,17A 'ibm':1A,20A 'let':7A 'local':4A 'malici':8A 'page':9A 'read':10A 'servic':6A 'set':13A 'web':5A","search_b":"'aspera':25B,32B 'attack':65B 'authent':40B 'chang':71B 'client':75B 'configur':59B 'connect':26B,33B 'cross':44B 'cross-origin':43B 'get':66B 'host':61B,73B 'http':36B 'ibm':24B,31B 'ibm-aspera-connect':23B 'includ':60B 'inform':68B 'linux':27B 'local':35B 'maco':28B 'modifi':57B 'origin':45B 'page':50B 'permiss':42B 'read':55B 'rule':46B 'sensit':67B 'servic':37B 'set':63B 'trust':62B,76B 'victim':52B 'visit':53B 'web':49B 'window':30B","search_c":"'1.6.1':80C '4.2.19':82C 'access':107C 'allow':84C 'aspera':78C 'attack':87C,125C 'authent':100C 'configur':96C,137C 'connect':79C 'control':108C 'could':83C,126C 'cross':105C,130C 'cross-origin':104C,129C 'due':97C 'host':94C 'http':112C 'ibm':77C 'inform':91C 'local':111C 'malici':121C 'miss':99C 'modifi':93C,136C 'obtain':89C 'origin':106C,131C 'over':102C 'page':123C 'perform':127C 'permiss':103C 'persuad':115C 'read':134C 'remot':86C 'request':132C 'sensit':90C 'servic':113C 'trust':95C 'unauthor':128C 'victim':117C 'visit':119C 'web':122C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T18:17:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120113","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120113","severity":null,"published_at":"2026-11-08T18:17:00+00:00","modified_at":"2026-11-08T18:17:00+00:00","first_seen_at":"2026-11-08T18:22:21+00:00","fetched_at":"2026-11-08T18:22:21+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}