CVE-2026-109158

The App Connect AI Agent could write environment details into logs

IBM · App Connect AI Agent error logging

First documented disclosure · Review checkpoint

Summary

The agent included sensitive deployment information in error messages. Log readers could learn sensitive details about the deployed environment.

Severity and exploitation evidence

High · 7.5/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The agent included sensitive deployment information in error messages.

Conditions required

The affected agent generated errors and someone could read those logs.

Potential impact

Log readers could learn sensitive details about the deployed environment.

Affected versions and configurations

Operator 12.1.0–12.21.0, 12.0.0–12.0.28 and 13.0.0–13.6.0. CNA operand ranges are 12.0.11.1-r1–12.0.12.5-r1, 12.0.12-r1–12.0.12-r28, 13.0.1.0-r1–13.0.6.2-r1 and 13.0.7.0-r1–13.0.9.0-r1.

Fix and mitigation status

CD and 13 LTS require operator 13.7.0+ with components 13.0.9.1-r1+. For 12 LTS use operator 12.0.29+ with components 12.0.12-r29+.

Practical next steps

Update the operator and its components together. Review access to AI agent error logs.

Operating lesson

Include diagnostic output when reviewing how agent software handles deployment secrets.

Evidence and limits

The CVE record was published on 2026-11-13.

Sources