CVE-2025-36058

Published: Jan 20, 2026Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: psirt@us.ibm.com (Secondary)

Description

IBM Business Automation Workflow containers 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 006. IBM Cloud Pak for Business Automation and IBM Business Automation Workflow containers may disclose sensitve configuration information in a config map.

Affected (15)

Products: Ibm: Business Automation Workflow

Ibm

1 product

Business Automation Workflow

Configuration A

15 vulnerable

Vulnerable Software	Affected Versions
Ibm Business Automation Workflow	Version 24.0.0
Ibm Business Automation Workflow	Version 24.0.0 if001
Ibm Business Automation Workflow	Version 24.0.0 if002
Ibm Business Automation Workflow	Version 24.0.0 if003
Ibm Business Automation Workflow	Version 24.0.0 if004
Ibm Business Automation Workflow	Version 24.0.0 if005
Ibm Business Automation Workflow	Version 24.0.0 if006
Ibm Business Automation Workflow	Version 24.0.1
Ibm Business Automation Workflow	Version 24.0.1 if001
Ibm Business Automation Workflow	Version 24.0.1 if002
Ibm Business Automation Workflow	Version 24.0.1 if004
Ibm Business Automation Workflow	Version 24.0.1 if005
Ibm Business Automation Workflow	Version 25.0.0
Ibm Business Automation Workflow	Version 25.0.0 if001
Ibm Business Automation Workflow	Version 25.0.0 if002

Related CWEs

CWE-538

Insertion of Sensitive Information into Externally-Accessible File or Directory

The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

References (1)

https://www.ibm.com/support/pages/node/7256777

Source: psirt@us.ibm.com

Vendor Advisory

Timeline

No history available yet.