---
id: "CVE-2026-14375"
page: "https://infrastack.ai/live/CVE-2026-14375"
kind: "vulnerability"
aliases: ["CVE-2026-14375"]
title: "IBM Storage Scale: TLS certificate checks missing, enabling forged responses"
severity: "medium"
cvss: 5.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["gpfs", "ibm-storage-scale", "infrastructure", "self-hosted"]
not_affected_if: ["no-remote-cluster-gui"]
published_at: "2026-11-08T18:17:01+00:00"
first_seen_at: "2026-11-08T18:22:21+00:00"
updated_at: "2026-11-08T18:22:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14375", "first_seen_at": "2026-11-08T18:22:21+00:00"}]
exploit_sources: []
---

# IBM Storage Scale: TLS certificate checks missing, enabling forged responses

Link for people: https://infrastack.ai/live/CVE-2026-14375 (this .md is for agents)

IBM Storage Scale does not properly validate TLS certificates when it talks to the GUI interfaces of remote clusters. A network attacker positioned in the middle can inject forged JSON responses.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed IBM Storage Scale version with `mmdiag --version` on a cluster node; the affected range is `5.2.3.0` through `5.2.3.8` and `6.0.1.0`.
- Confirm whether remote cluster GUI connections are configured in your deployment; unknown if the sources say more.

## Fix

- Move to a fixed IBM Storage Scale release; the sources do not name the fixed version, so unknown.

## Timeline

- 2026-11-08T18:22:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-14375

## From the sources

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.1.0 does not validate or improperly validates TLS certificate validation when communicating with remote cluster GUI interfaces, which could allow an attacker to inject forged JSON responses using man in the middle techniques.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_