{"id":"CVE-2026-15661","kind":"vulnerability","aliases":["CVE-2026-15661"],"related":[],"title":"IBM Concert: unauthorized users can inject data into log messages","description":"IBM Concert 1.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.","summary":"IBM Concert versions 1.0 through 3.0.0 do not neutralize special characters before writing to log files. An unauthorized user can inject crafted data into log entries, which can corrupt or mislead log review.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-concert","self-hosted","vendor"],"not_affected_if":[],"how_to_check":"- Check the installed IBM Concert version against the affected range 1.0 through 3.0.0 in the product admin console or deployment metadata\n- unknown for further detail, the sources do not say how to read the version locally","fix":"- Move IBM Concert to a release later than `3.0.0` as published in the IBM security bulletin\n- unknown for the exact fixed version, the sources do not say","status":"open","published_at":"2026-10-19T17:17:20+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:25:02+00:00","updated_at":"2026-10-25T04:25:02+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:25:02Z","model":"claude-haiku-5-5","output":{"fix":"- Move IBM Concert to a release later than `3.0.0` as published in the IBM security bulletin\n- unknown for the exact fixed version, the sources do not say","reach":"unknown","title":"IBM Concert: unauthorized users can inject data into log messages","impact":"low","summary":"IBM Concert versions 1.0 through 3.0.0 do not neutralize special characters before writing to log files. An unauthorized user can inject crafted data into log entries, which can corrupt or mislead log review.","category":"vendor","nicknames":[],"who_cares":["ibm-concert","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Forged or misleading entries appear in application log files","analyst_note":"Find the IBM security bulletin for CVE-2026-15661 to confirm the fixed version and whether unauthenticated requests reach the logging path.","how_to_check":"- Check the installed IBM Concert version against the affected range 1.0 through 3.0.0 in the product admin console or deployment metadata\n- unknown for further detail, the sources do not say how to read the version locally","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running IBM Concert versions 1.0 through 3.0.0 are affected. The sources do not say which deployment modes or configurations make the log path reachable by unauthorized users, so exposure beyond the version range is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000592,"input_tokens":3277,"output_tokens":528,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-15661':13A,16A '-2026':12A,15A '1.0':27B,59C '3.0.0':29B,61C 'allow':63C 'charact':34B 'concert':2A,19B,25B,58C 'corrupt':52B 'could':62C 'craft':45B 'cve':11A,14A 'data':7A,46B,69C 'due':73C 'element':79C 'entri':49B 'file':39B,84C 'host':22B 'ibm':1A,18B,24B,57C 'ibm-concert':17B 'improp':75C 'inject':6A,44B,68C 'log':9A,38B,48B,55B,71C,83C 'messag':10A,72C 'mislead':54B 'neutral':32B,76C 'review':56B 'self':21B 'self-host':20B 'special':33B,78C 'unauthor':3A,41B,65C 'user':4A,42B,66C 'vendor':23B 'version':26B 'write':36B 'written':81C","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM Concert versions 1.0 through 3.0.0 are affected. The sources do not say which deployment modes or configurations make the log path reachable by unauthorized users, so exposure beyond the version range is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T17:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-15661","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15661","severity":null,"published_at":"2026-10-19T17:17:20+00:00","modified_at":"2026-10-22T21:17:18+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}