CVE-2026-14375 · Infrastructure
NO FIX YET · SEE WHAT TO DO
IBM Storage Scale does not properly validate TLS certificates when it talks to the GUI interfaces of remote clusters. A network attacker positioned in the middle can inject forged JSON responses.
first public Nov 8, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running IBM Storage Scale 5.2.3.0 through 5.2.3.8 or 6.0.1.0 that use remote cluster GUI communication are exposed. An attacker must be able to intercept traffic between clusters, so systems without remote cluster GUI links are less exposed. unknown whether other configurations are affected.
Not affected if no-remote-cluster-gui
Who cares gpfs, ibm-storage-scale, self-hosted
mmdiag --version on a cluster node; the affected range is 5.2.3.0 through 5.2.3.8 and 6.0.1.0.IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.1.0 does not validate or improperly validates TLS certificate validation when communicating with remote cluster GUI interfaces, which could allow an attacker to inject forged JSON responses using man in the middle techniques.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.