ibmCVE-2026-17472

IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to access or modify unauthorized resources due to the use of wildcards in RBAC permission definitions.

Critical9.6CVE-2026-17472 · Published Sep 22, 2026 · updated Sep 24, 2026

Affected versions

Package	Affected	Fixed in
Concert Vendor	>= 1.0.0, <= 3.0.0	No fix yet

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Severity from: no source yet
Weakness: CWE-269

More ibm advisories

All

Date	Advisory	Severity	Fixed in
Sep 22	IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to cause a denial of service using a specially crafted regular expression that would cause excessive resource consumption. CVE-2025-12767Medium5.3no fix yet	Medium5.3	No fix yet
Sep 22	IBM Concert 1.0.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. CVE-2025-36084Medium5.9no fix yet	Medium5.9	No fix yet
Sep 22	IBM Concert 1.0.0 through 3.0.0 could allow a local attacker to obtain sensitive information due to recursive copying of build context directories into container images. CVE-2026-15915Medium6.2no fix yet	Medium6.2	No fix yet
Sep 22	IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. CVE-2026-16346Critical9.9no fix yet	Critical9.9	No fix yet
Sep 22	IBM Concert 1.0.0 through 3.0.0 is vulnerable to server-side request forgery (SSRF). CVE-2026-16426Medium6.5no fix yet	Medium6.5	No fix yet
Sep 22	IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. CVE-2026-16468High8.8no fix yet	High8.8	No fix yet

Affected versions

More ibm advisories

Critical advisories by email