What is the CVSS score of CVE-2026-13460?

CVE-2026-13460 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of IBM Storage Scale are affected by CVE-2026-13460?

IBM Storage Scale GUI versions 5.2.3.0 through 6.0.1.0 contain hardcoded authentication tokens in source code that enable any network-reachable attacker to access REST API and inter-node cluster…. A patch is available.

How to fix or mitigate CVE-2026-13460?

Within 24 hours, identify all IBM Storage Scale GUI instances running affected versions (5.2.3.0-5.2.3.8 or 6.0.0.0-6.0.1.0) and assess their network exposure; restrict network access to these systems if not already isolated from untrusted networks. Within 7 days, apply the patch released by IBM via advisory 7283308 to all affected instances and rotate authentication credentials and API tokens as a precaution. Within 30 days, verify patch deployment across all systems through version confirmation, audit pre-patch access logs for suspicious REST API or cluster communication activity, and document remediation completion.

IBM Storage Scale CVE-2026-13460

EUVD-2026-58361 HIGH

Use of Hard-coded Credentials (CWE-798)

2026-08-13 ibm

GHSA-xr96-mx7v-w32h

Authentication Bypass IBM Storage Scale

7.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-accessible REST API with a uniform hardcoded token effectively negates authentication (PR:N); only confidentiality impact applies as no write or availability effects are described.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 20:39 vuln.today

CVE Published

Aug 13, 2026 - 19:37 nvd

HIGH 7.5

DescriptionCVE.org

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI.

AnalysisAI

IBM Storage Scale GUI versions 5.2.3.0-5.2.3.8 and 6.0.0.0-6.0.1.0 ship with a hardcoded authentication token embedded in source code, granting any network-reachable attacker the ability to authenticate to the REST API and inter-node cluster communication channels without valid credentials. The static nature of the token means it is identical across every affected deployment, making a single disclosure universally exploitable against all unpatched instances. IBM has released a patch via advisory 7283308, and no public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

IBM Storage Scale (formerly IBM Spectrum Scale / GPFS) is an enterprise parallel file system used in HPC and large-scale storage environments. The vulnerability resides in the GUI component, which manages cluster administration and coordinates inter-node communication via a REST API. CWE-798 (Use of Hard-coded Credentials) identifies the root cause: a static token baked into the application source code at build time, used as a shared secret for both inter-node cluster communication and REST API authentication between GUI instances. Because the token is static and uniform across all affected installations - spanning CPE cpe:2.3:a:ibm:storage_scale:*:*:*:*:*:*:*:* - it cannot be rotated, revoked, or uniquely scoped per deployment. An attacker who obtains the token through source inspection, binary extraction, or disclosure can replay it against any vulnerable GUI endpoint to impersonate a legitimate cluster node.

RemediationAI

IBM has released a patch addressing this vulnerability; the authoritative fixed version details and upgrade instructions are available at https://www.ibm.com/support/pages/node/7283308, and administrators should consult this advisory directly since the exact patched version string was not independently confirmed in the available data. As an immediate compensating control prior to patching, restrict network access to the Storage Scale GUI and its REST API port using firewall rules or network segmentation, limiting reachability exclusively to trusted management hosts or VLANs - note this does not eliminate the hardcoded token but substantially reduces the attack surface by preventing external access. If inter-node GUI REST API communication is not operationally required in a given environment, disabling or binding the service to loopback or a dedicated management interface is a viable short-term measure, though this may impact cluster management functionality and should be validated against operational requirements before implementation.