CVE-2026-13460 identifies a vulnerability in IBM Storage Scale where a hardcoded token is embedded in the GUI source code. This token facilitates inter-node cluster communication and REST API authentication between GUI components. The affected versions explicitly include 5.2.3.0 and 6.0.0.0, with the description indicating the issue spans through 5.2.3.8 and 6.0.1.0. The vulnerability is classified under CWE-798 (Use of Hard-coded Credentials) and has a CVSS 3.1 base score of 7.5, indicating high severity. No official remediation or patch information is provided in the available data, and no known exploits are reported in the wild.

The vulnerability allows an unauthenticated remote attacker to leverage the hardcoded token to gain unauthorized access to inter-node cluster communications and REST API functions. This can lead to unauthorized information disclosure (confidentiality impact is high), but there is no indication of integrity or availability impact. Exploitation could compromise sensitive cluster operations or data accessible via the REST API.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected IBM Storage Scale GUI interfaces and inter-node communication channels to trusted administrators only. Monitor for any vendor updates or advisories regarding patches or workarounds.