{"affected":[{"product":"App Connect Operator","source":"CNA: ibm","vendor":"IBM","versions":[{"lessThanOrEqual":"12.21.0","status":"affected","version":"12.1.0","versionType":"semver"},{"lessThanOrEqual":"12.0.28","status":"affected","version":"12.0.0","versionType":"semver"},{"lessThanOrEqual":"13.6.0","status":"affected","version":"13.0.0","versionType":"semver"}]},{"product":"App Connect Enterprise Certified Containers Operands","source":"CNA: ibm","vendor":"IBM","versions":[{"lessThanOrEqual":"12.0.12.5-r1","status":"affected","version":"12.0.11.1-r1","versionType":"custom"},{"lessThanOrEqual":"13.0.6.2-r1","status":"affected","version":"13.0.1.0-r1","versionType":"custom"},{"lessThanOrEqual":"12.0.12-r28","status":"affected","version":"12.0.12-r1","versionType":"custom"},{"lessThanOrEqual":"13.0.9.0-r1","status":"affected","version":"13.0.7.0-r1","versionType":"custom"}]}],"cveId":"CVE-2026-114468","cwes":["CWE-798"],"description":"IBM App Connect Operator and App Connect Enterprise Certified Containers Operands could allow an attacker with the ability to run HTTP calls within the running container to can make administrative calls to a running IntegrationRuntime.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6,"severity":"medium","source":"CNA: ibm","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},{"score":6,"severity":"medium","source":"NVD: psirt@us.ibm.com","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","version":"3.1"}],"modifiedAt":1794608241553,"publishedAt":1794607144689,"references":[{"source":"CNA: ibm","tags":["vendor-advisory","patch"],"url":"https://www.ibm.com/support/pages/node/7296008"},{"source":"psirt@us.ibm.com","tags":[],"url":"https://www.ibm.com/support/pages/node/7296008"}],"remediation":[{"kind":"fix","source":"CNA: ibm","text":"IBM strongly suggests the following:\n\n\n\nApp Connect Enterprise Certified Container CD and 13 LTS (Long Term Support)\n\n\n\nUpgrade to App Connect Enterprise Certified Container Operator version 13.7.0 or higher, and ensure that all components are at 13.0.9.1-r1 or higher.  Documentation on the upgrade process is available at  https://www.ibm.com/docs/en/app-connect/13.0?topic=releases-upgrading-operator \n\n\n\n\nApp Connect Enterprise Certified Container 12.0 LTS (Long Term Support)\n\n\n\nUpgrade to App Connect Enterprise Certified Container Operator version 12.0.29 or higher, and ensure that all components are at 12.0.12-r29 or higher.  Documentation on the upgrade process is available at  https://www.ibm.com/docs/en/app-connect/12.0?topic=umfpr-upgrading-operator-releases"},{"kind":"fix","source":"CNA: ibm","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://www.ibm.com/support/pages/node/7296008"}],"revision":"3989b9ea0b621474ba2651fa966895e36d58c745035616bc806b2a5033497b21","sources":[{"modifiedAt":1794607298463,"name":"CNA: ibm","retrievedAt":1794611302755,"url":"https://www.cve.org/CVERecord?id=CVE-2026-114468"},{"modifiedAt":1794608241553,"name":"NVD","retrievedAt":1794615615395,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114468"}],"ssvc":null,"status":"published","title":"IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands Hard-coded Credentials","updatedAt":1794615615395}