{"api_version":"1","generated_at":"2026-11-13T23:53:17+00:00","cve":"CVE-2026-115788","urls":{"html":"https://cve.report/CVE-2026-115788","api":"https://cve.report/api/cve/CVE-2026-115788.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-115788","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-115788"},"summary":{"title":"IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands Log Forging","description":"IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands is vulnerable to Log Forging on a request to create a resource.","state":"PUBLISHED","assigner":"ibm","published_at":"2026-11-13 22:17:21","updated_at":"2026-11-13 22:17:21"},"problem_types":["CWE-117","CWE-117 CWE-117 Improper Output Neutralization for Logs"],"metrics":[{"version":"3.1","source":"psirt@us.ibm.com","type":"Primary","score":"8.1","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"8.1","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}}],"references":[{"url":"https://www.ibm.com/support/pages/node/7296008","name":"https://www.ibm.com/support/pages/node/7296008","refsource":"psirt@us.ibm.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-115788","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115788","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"IBM","product":"App Connect Operator","version":"affected 12.1.0 12.21.0 semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"App Connect Operator","version":"affected 12.0.0 12.0.28 semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"App Connect Operator","version":"affected 13.0.0 13.6.0 semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"App Connect Enterprise Certified Containers Operands","version":"affected 12.0.11.1-r1 12.0.12.5-r1 custom","platforms":[]},{"source":"CNA","vendor":"IBM","product":"App Connect Enterprise Certified Containers Operands","version":"affected 13.0.1.0-r1 13.0.6.2-r1 custom","platforms":[]},{"source":"CNA","vendor":"IBM","product":"App Connect Enterprise Certified Containers Operands","version":"affected 12.0.12-r1 12.0.12-r28 custom","platforms":[]},{"source":"CNA","vendor":"IBM","product":"App Connect Enterprise Certified Containers Operands","version":"affected 13.0.7.0-r1 13.0.9.0-r1 custom","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"IBM strongly suggests the following:\nApp Connect Enterprise Certified Container CD and 13 LTS (Long Term Support)\nUpgrade to App Connect Enterprise Certified Container Operator version 13.7.0 or higher, and ensure that all components are at 13.0.9.1-r1 or higher. Documentation on the upgrade process is available at https://www.ibm.com/docs/en/app-connect/13.0?topic=releases-upgrading-operator\n\nApp Connect Enterprise Certified Container 12.0 LTS (Long Term Support)\nUpgrade to App Connect Enterprise Certified Container Operator version 12.0.29 or higher, and ensure that all components are at 12.0.12-r29 or higher. Documentation on the upgrade process is available at https://www.ibm.com/docs/en/app-connect/12.0?topic=umfpr-upgrading-operator-releases","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"cpes":["cpe:2.3:a:ibm:app_connect_operator:12.1.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:app_connect_operator:12.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:app_connect_operator:13.0.0:*:*:*:*:*:*:*"],"product":"App Connect Operator","vendor":"IBM","versions":[{"lessThanOrEqual":"12.21.0","status":"affected","version":"12.1.0","versionType":"semver"},{"lessThanOrEqual":"12.0.28","status":"affected","version":"12.0.0","versionType":"semver"},{"lessThanOrEqual":"13.6.0","status":"affected","version":"13.0.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:ibm:app_connect_enterprise_certified_containers_operands:cd:12.0.11.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:app_connect_enterprise_certified_containers_operands:cd:13.0.1.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:app_connect_enterprise_certified_containers_operands:cd:12.0.12:*:*:*:*:*:*:*","cpe:2.3:a:ibm:app_connect_enterprise_certified_containers_operands:cd:13.0.7.0:*:*:*:*:*:*:*"],"product":"App Connect Enterprise Certified Containers Operands","vendor":"IBM","versions":[{"lessThanOrEqual":"12.0.12.5-r1","status":"affected","version":"12.0.11.1-r1","versionType":"custom"},{"lessThanOrEqual":"13.0.6.2-r1","status":"affected","version":"13.0.1.0-r1","versionType":"custom"},{"lessThanOrEqual":"12.0.12-r28","status":"affected","version":"12.0.12-r1","versionType":"custom"},{"lessThanOrEqual":"13.0.9.0-r1","status":"affected","version":"13.0.7.0-r1","versionType":"custom"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands is vulnerable to Log Forging on a request to create a resource.</p>"}],"value":"IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands is vulnerable to Log Forging on a request to create a resource."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-117","description":"CWE-117 Improper Output Neutralization for Logs","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-13T22:01:07.122Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm"},"references":[{"tags":["vendor-advisory","patch"],"url":"https://www.ibm.com/support/pages/node/7296008"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>IBM strongly suggests the following:</p><p><strong>App Connect Enterprise Certified Container CD and 13 LTS (Long Term Support)</strong></p><p>Upgrade to App Connect Enterprise Certified Container Operator version 13.7.0 or higher, and ensure that all components are at 13.0.9.1-r1 or higher.  Documentation on the upgrade process is available at <a href=\"https://www.ibm.com/docs/en/app-connect/13.0?topic=releases-upgrading-operator\" rel=\"nofollow\">https://www.ibm.com/docs/en/app-connect/13.0?topic=releases-upgrading-operator</a></p><p><br/><strong>App Connect Enterprise Certified Container 12.0 LTS (Long Term Support)</strong></p><p>Upgrade to App Connect Enterprise Certified Container Operator version 12.0.29 or higher, and ensure that all components are at 12.0.12-r29 or higher.  Documentation on the upgrade process is available at <a href=\"https://www.ibm.com/docs/en/app-connect/12.0?topic=umfpr-upgrading-operator-releases\" rel=\"nofollow\">https://www.ibm.com/docs/en/app-connect/12.0?topic=umfpr-upgrading-operator-releases</a></p>"}],"value":"IBM strongly suggests the following:\nApp Connect Enterprise Certified Container CD and 13 LTS (Long Term Support)\nUpgrade to App Connect Enterprise Certified Container Operator version 13.7.0 or higher, and ensure that all components are at 13.0.9.1-r1 or higher. Documentation on the upgrade process is available at https://www.ibm.com/docs/en/app-connect/13.0?topic=releases-upgrading-operator\n\nApp Connect Enterprise Certified Container 12.0 LTS (Long Term Support)\nUpgrade to App Connect Enterprise Certified Container Operator version 12.0.29 or higher, and ensure that all components are at 12.0.12-r29 or higher. Documentation on the upgrade process is available at https://www.ibm.com/docs/en/app-connect/12.0?topic=umfpr-upgrading-operator-releases"}],"title":"IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands Log Forging"}},"cveMetadata":{"assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","assignerShortName":"ibm","cveId":"CVE-2026-115788","datePublished":"2026-11-13T22:01:07.122Z","dateReserved":"2026-10-23T13:52:20.386Z","dateUpdated":"2026-11-13T22:01:07.122Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-13 22:17:21","lastModifiedDate":"2026-11-13 22:17:21","problem_types":["CWE-117","CWE-117 CWE-117 Improper Output Neutralization for Logs"],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"115788","Ordinal":"1","Title":"IBM App Connect Operator and IBM App Connect Enterprise Certifie","CVE":"CVE-2026-115788","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"115788","Ordinal":"1","NoteData":"IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands is vulnerable to Log Forging on a request to create a resource.","Type":"Description","Title":"IBM App Connect Operator and IBM App Connect Enterprise Certifie"}]}}}