CVE-2026-18097 describes a vulnerability in IBM Db2 where plaintext passwords are logged in trace files, potentially exposing sensitive credentials to local attackers. Affected versions include 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on Linux, UNIX, and Windows platforms, including DB2 Connect Server. The vulnerability is due to improper handling of sensitive information in logs (CWE-532). The CVSS v3.1 base score is 5.5, reflecting a medium severity with local attack vector and low attack complexity, requiring low privileges and no user interaction. There is no known exploit in the wild and no official remediation level or patch has been disclosed at this time.

Local attackers with access to the system could retrieve plaintext passwords from Db2 trace log files, leading to potential credential compromise. This exposure affects confidentiality but does not impact integrity or availability. The vulnerability requires local access and low privileges but no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to Db2 trace files to trusted administrators only and monitor for unauthorized local access. Avoid enabling verbose logging that may include sensitive information if possible.