CVE-2025-36058

MEDIUM

IBM Business Automation Workflow <25.0.0-24.0.1 - Info Disclosure

Title source: llm
STIX 2.1

Description

IBM Business Automation Workflow containers 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 006. IBM Cloud Pak for Business Automation and IBM Business Automation Workflow containers may disclose sensitve configuration information in a config map.

References (1)

Core 1
Core References
Vendor Advisory vendor-advisory patch
https://www.ibm.com/support/pages/node/7256777

Scores

CVSS v3 5.5
EPSS 0.0011
EPSS Percentile 1.5%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-538
Status published
Products (3)
ibm/business_automation_workflow 24.0.0 (7 CPE variants)
ibm/business_automation_workflow 24.0.1 (5 CPE variants)
ibm/business_automation_workflow 25.0.0 (3 CPE variants)
Published Jan 20, 2026
Tracked Since Feb 18, 2026