Description

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in trace files.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-12T21:17:36.930Z",
  "pubdate": "2026-08-12T21:17:36.930Z",
  "executiveSummary": "IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 for Linux, UNIX, and Windows (including DB2 Connect Server) contain an information disclosure vulnerability.\nThe flaw stems from the insecure logging of plain text passwords into diagnostic trace files generated by the database management system.\nA local attacker with appropriate access to the system can read these trace files and harvest sensitive credentials, specifically plain text passwords.\nThis exposure undermines authentication security and compromises confidentiality across the affected database environment.\nSuccessful exploitation requires local access to the underlying operating system where the database instance is deployed and where trace files are written.\nMitigation requires applying vendor-supplied updates or implementing strict file-system permission hardening to restrict access to trace directories.",
  "technicalDetails": "The root cause of this vulnerability lies in the internal debugging and diagnostic tracing mechanisms of IBM Db2, which improperly handle sensitive authentication parameters.\nDuring specific operational workflows or error conditions, the database engine captures runtime parameters and internal function arguments for diagnostic purposes.\nInstead of masking or omitting sensitive data, the logging subsystem writes plain text passwords directly into diagnostic trace files stored on the local file system.\nThe vulnerable components include the tracing and logging facilities within IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 for Linux, UNIX, and Windows, encompassing DB2 Connect Server.\nAn attacker must possess local system access to the host running the database instance to exploit this vulnerability.\nThe attack flow proceeds as follows: first, the attacker gains local execution or read privileges on the host operating system, either through a compromised lower-privileged account, a misconfigured service, or a separate local vulnerability.\nSecond, the attacker navigates to the directory paths where IBM Db2 stores diagnostic logs, service logs, or trace output.\nThird, the attacker reads the contents of these trace files, searching for strings associated with authentication sequences where plain text passwords were inadvertently recorded during routine or debugging operations.\nUpon successful extraction of these credentials, the attacker achieves post-exploitation impact by leveraging the harvested plain text passwords to authenticate as legitimate database users or administrators.\nThis unauthorized credential access can lead to privilege escalation within the database, unauthorized data exfiltration, database manipulation, or further lateral movement across the internal network, depending on the privileges of the compromised accounts."
}