# CVE-2026-109158: IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands Insertion of Sensitive Information into Log File

Status: published. Published: 2026-11-13. Updated: 2026-11-13.

IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands may allow the AI Agent to log sensitive information about the deployed environment within error messages.

## Remediation

- fix: IBM strongly suggests the following:



App Connect Enterprise Certified Container CD and 13 LTS (Long Term Support)



Upgrade to App Connect Enterprise Certified Container Operator version 13.7.0 or higher, and ensure that all components are at 13.0.9.1-r1 or higher.  Documentation on the upgrade process is available at  https://www.ibm.com/docs/en/app-connect/13.0?topic=releases-upgrading-operator 




App Connect Enterprise Certified Container 12.0 LTS (Long Term Support)



Upgrade to App Connect Enterprise Certified Container Operator version 12.0.29 or higher, and ensure that all components are at 12.0.12-r29 or higher.  Documentation on the upgrade process is available at  https://www.ibm.com/docs/en/app-connect/12.0?topic=umfpr-upgrading-operator-releases (source: CNA: ibm)
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: ibm) — https://www.ibm.com/support/pages/node/7296008

## Affected products and versions

- IBM / App Connect Operator: ≥ 12.1.0; ≤ 12.21.0 (affected, semver); ≥ 12.0.0; ≤ 12.0.28 (affected, semver); ≥ 13.0.0; ≤ 13.6.0 (affected, semver). Source: CNA: ibm
- IBM / App Connect Enterprise Certified Containers Operands: ≥ 12.0.11.1-r1; ≤ 12.0.12.5-r1 (affected, custom); ≥ 13.0.1.0-r1; ≤ 13.0.6.2-r1 (affected, custom); ≥ 12.0.12-r1; ≤ 12.0.12-r28 (affected, custom); ≥ 13.0.7.0-r1; ≤ 13.0.9.0-r1 (affected, custom). Source: CNA: ibm

## Severity and prioritization

- CVSS 3.1: 7.5 (high); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N; source: CNA: ibm

- CVSS 3.1: 7.5 (high); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N; source: NVD: psirt@us.ibm.com

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-532

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://www.ibm.com/support/pages/node/7296008 (CNA: ibm; vendor-advisory, patch)

- https://www.ibm.com/support/pages/node/7296008 (psirt@us.ibm.com)

## Provenance

- CNA: ibm: https://www.cve.org/CVERecord?id=CVE-2026-109158; retrieved 2026-11-13; source updated 2026-11-13

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109158; retrieved 2026-11-14; source updated 2026-11-13

Revision: 8b01ff35f59197068bef27cc237f8529b6c69d3109e8279787875fb6ea75066c

Canonical: https://y2.dev/cve/CVE-2026-109158

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.