CVE-2025-13490

IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that report metrics are vulnerable to loss of confidentiality

State: Published
Severity: 5.9 Medium
Published: Mar 3, 2026
Updated: Mar 4, 2026
Reserved: Nov 20, 2025

Read the record on cve.org

Description

IBM App Connect Operator versions CD 11.3.0 through 11.6.0 and 12.1.0 through 12.20.0, LTS versions 12.0.0 through 12.0.20, and IBM App Connect Enterprise Certified Containers Operands versions CD 12.0.11.2‑r1 through 12.0.12.5‑r1 and 13.0.1.0‑r1 through 13.0.6.1‑r1, and LTS versions 12.0.12‑r1 through 12.0.12‑r20, contain a vulnerability in which the IBM App Connect Enterprise Certified Container transmits data in clear text, potentially allowing an attacker to intercept and obtain sensitive information through man‑in‑the‑middle techniques.

Scores

CVSS	Score	Vector	Source
3.1	5.9 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N	ibm

Weaknesses

CWE-319 Cleartext Transmission of Sensitive Information

Affected Products

Product	Versions
App Connect OperatorIBM	CD:11.3.0 through 11.6.0, 12.1.0 - 12.20.112.0 LTS:12.0.0 - 12.0.20Affected
App Connect EnterpriseCertified Containers OperandsIBM	CD:12.0.11.2 through r1 - 12.0.12.5-r1, 13.0.1.0-r1 - 13.0.6.1-r112.0 LTS:12.0.12-r1 - 12.0.12-r20Affected

References

https://www.ibm.com/support/pages/node/7262271vendor-advisorypatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.