IBM Concert CVE-2025-36154

Requires that IBM Concert (versions 1.0.0 through 2.1.0) is actually performing RECURSIVE docker builds - the specific feature during which secrets are written in cleartext - and that the attacker already holds local user access to the host where those builds and their artifacts reside. Exploitation is limited to confidentiality (secret/credential disclosure); there is no integrity or availability impact and no network-based vector. The realistic risk hinges on who can access the build host: in a hardened CI/build environment with restricted local accounts, the exposure is materially reduced.

This is a low-real-risk issue despite its MEDIUM 6.2 CVSS base score, driven almost entirely by the C:H impact rather than exploitability. The CVSS vector is internally consistent and the local-access framing is confirmed by the description: AV:L requires the attacker to already be a local user on the host performing the docker builds, which is the dominant limiting factor. EPSS is 0.10% at the 1st percentile - among the lowest possible - reflecting that this cleartext-storage flaw is not remotely reachable and not a mass-exploitation candidate. There is no CISA KEV listing and no public exploit code identified at time of analysis; exploitation status is therefore 'no public exploit identified at time of analysis.' A notable nuance: the vector sets PR:N (no privileges) yet AV:L (local) - this is defensible because the description says the data 'could be obtained by a local user' with no stated privilege requirement, but defenders should note that gaining ANY local presence on the build host is itself a meaningful prerequisite that CVSS does not capture well. No signals conflict; all point to a low-urgency, confidentiality-only information-disclosure requiring prior local access.

An attacker who already has a local account or shell on the host running IBM Concert's recursive docker builds inspects build artifacts, intermediate layers, or on-disk files and recovers secrets (credentials, tokens, or keys) that Concert wrote in cleartext during the build. No public proof-of-concept exists; given AV:L/AC:L, exploitation is trivial once local access is obtained but requires that foothold first.