CVE-2026-17442: CWE-532 Insertion of Sensitive Information into Log File in IBM App Connect Enterprise

The vulnerability identified as CVE-2026-17442 involves the insertion of sensitive information, specifically credentials, into trace log files in IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.1, 12.0.1.0 through 12.0.12.28, and IBM Integration Bus for z/OS versions 10.1.0.0 through 10.1.0.7. This allows a local attacker to access sensitive data by reading these logs. The CVSS 3.1 base score is 5.1, reflecting a medium severity with local attack vector, high attack complexity, no privileges required, no user interaction, and impact limited to confidentiality.

The impact is the potential disclosure of sensitive credentials to a local attacker who can access trace logs. This compromises confidentiality but does not affect integrity or availability. The vulnerability requires local access and has high attack complexity, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trace logs to trusted users only and monitor for unauthorized access. Avoid logging sensitive credentials in cleartext if possible through configuration changes.