---
id: "CVE-2026-15661"
kind: "vulnerability"
aliases: ["CVE-2026-15661"]
title: "IBM Concert: unauthorized users can inject data into log messages"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["ibm-concert", "self-hosted", "vendor"]
not_affected_if: []
published_at: "2026-10-19T17:17:20+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T04:25:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15661", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# IBM Concert: unauthorized users can inject data into log messages

IBM Concert versions 1.0 through 3.0.0 do not neutralize special characters before writing to log files. An unauthorized user can inject crafted data into log entries, which can corrupt or mislead log review.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed IBM Concert version against the affected range 1.0 through 3.0.0 in the product admin console or deployment metadata
- unknown for further detail, the sources do not say how to read the version locally

## Fix

- Move IBM Concert to a release later than `3.0.0` as published in the IBM security bulletin
- unknown for the exact fixed version, the sources do not say

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-15661

## From the sources

IBM Concert 1.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_