Skip to content
OpenAdvisories
Medium WID-SEC-2026-0574 7 CVEs

IBM App Connect Enterprise: Mehrere Schwachstellen

Published Mar 2, 2026 · Updated Mar 3, 2026 · Revision 2 · de-DE

Vendor: IBM Product: App Connect Enterprise Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um einen Denial of Service Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, und um einen Cross-Site Scripting Angriff durchzuführen.

Product

IBM App Connect Enterprise kombiniert die branchenbewährten Technologien des IBM Integration Bus mit Cloud-nativen Technologien.

Vulnerabilities 7

  • High 7.1
    CVE-2026-25536

    @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

    MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections…

    Model Context Protocol typescript-sdk langfuse-3-worker langfuse-3 Wolfi npm
  • Medium 6.3
    CVE-2026-24473

    Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)

    Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Serve static Middleware for the Cloudflare Workers adapter contains an information disclosure vulnerability that may allow attackers to read arbitra…

    honojs hono langfuse-3-worker hono Wolfi npm
  • Medium 5.9
    CVE-2025-13490

    IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that report metrics are vulnerable to loss of confidentiality

    IBM App Connect Operator versions CD 11.3.0 through 11.6.0 and 12.1.0 through 12.20.0, LTS versions 12.0.0 through 12.0.20, and IBM App Connect Enterprise Certified Containers Operands versions CD 12.0.11.2‑r1 through 12.0.12.5‑r1 and 13.0.1.0‑r1 through 13.0…

    IBM App Connect Operator App Connect EnterpriseCertified Containers Operands
  • Medium 5.3
    CVE-2026-2327

    markdown-it is has a Regular Expression Denial of Service (ReDoS)

    Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a n…

    renovate vitess-23 node-markdown-it markdown-it Ubuntu Wolfi npm
  • Medium 5.3
    CVE-2026-24472

    Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception

    Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Cache Middleware contains an information disclosure vulnerability caused by improper handling of HTTP cache control directives. The middleware does …

    honojs hono langfuse-3-worker hono Wolfi npm
  • Medium 4.8
    CVE-2026-24398

    Hono's IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing

    Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, IP Restriction Middleware in Hono is vulnerable to an IP address validation bypass. The `IPV4_REGEX` pattern and `convertIPv4ToBinary` function in `…

    honojs hono langfuse-3-worker hono Wolfi npm
  • Medium 4.7
    CVE-2026-24771

    Hono has a Cross-site Scripting vulnerability

    Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, a Cross-Site Scripting (XSS) vulnerability exists in the `ErrorBoundary` component of the hono/jsx library. Under certain usage patterns, untrusted …

    honojs hono langfuse-3-worker hono Wolfi npm

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2025-208249

  2. #1

    Initiale Fassung

References