Description

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to improper logging of credentials.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.2",
  "pubDate": "2026-09-04T17:16:52.250Z",
  "pubdate": "2026-09-04T17:16:52.250Z",
  "executiveSummary": "A sensitive information disclosure vulnerability exists in IBM App Connect Enterprise and IBM Integration Bus for z/OS due to improper logging practices.\nThe vulnerability occurs when the application logs credentials in cleartext during internal processes, potentially exposing sensitive authentication material to unauthorized users with local access.\nAffected products include IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.1 and 12.0.1.0 through 12.0.12.28, as well as IBM Integration Bus for z/OS versions 10.1.0.0 through 10.1.0.7.\nThe risk is categorized as information disclosure, where a local attacker could read application logs to gain credentials.\nSuccessful exploitation requires local access to the server where the product is installed to view the insecurely written log files.\nOrganizations should restrict file system access to log directories and monitor for the presence of credentials in log output.",
  "technicalDetails": "The vulnerability is classified as an improper logging of sensitive information, where the internal components of IBM App Connect Enterprise and IBM Integration Bus for z/OS inadvertently write cleartext credentials to log files during specific operations.\nThis occurs because the application’s logging mechanism fails to mask or omit sensitive strings—such as user credentials, passwords, or authentication tokens—when processing requests or performing system tasks.\nThe root cause lies in the insufficient sanitization of data before it is persisted to the local file system. Because these logs are typically stored in plain text on the local disk, any user or process with sufficient local privileges to read the application's log directory can retrieve these sensitive credentials.\nThe attack flow involves a local threat actor accessing the host system where the vulnerable IBM App Connect Enterprise or Integration Bus for z/OS instance resides. Once access is obtained, the attacker performs unauthorized read operations on the application's log files. The attacker then scans the contents of these logs to identify and extract credentials used by the integration nodes, service accounts, or administrative interfaces.\nThis vulnerability does not require remote network exploitation; it is strictly a local privilege and information disclosure issue. However, the impact is significant, as the compromised credentials may grant the attacker elevated access to backend systems, databases, or further administrative control over the integration environment.\nThe affected component is the internal logging framework utilized by the integration engines across the specified versions of IBM App Connect Enterprise (13.0.1.0 to 13.0.8.1 and 12.0.1.0 to 12.0.12.28) and IBM Integration Bus for z/OS (10.1.0.0 to 10.1.0.7).\nPost-exploitation, the attacker can leverage the discovered credentials to move laterally within the network or gain unauthorized access to connected enterprise services that rely on these credentials for authentication. Because log files are often retained for auditing purposes, the window of exposure may persist long after the initial credential usage, providing the attacker with retrospective access to sensitive authentication material."
}