CVE Catalog
CVE-2026-18097
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk0.15%
4th percentile - higher than 4% of all known CVEs
Summary
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in trace files.
Risk Assessment
Risk of password disclosure in trace files, potentially enabling unauthorized access to databases.
Recommendation
Update IBM Db2 to a version that includes the fix for masking passwords in trace files.
Original NVD description (English source)
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in trace files.