IBM Concert EUVD-2026-84875

Requires that IBM Concert's container build process recursively copies build context directories into images (the vulnerable default behavior in versions 1.0.0 through 3.0.0), causing sensitive files present in the build context to be embedded in the resulting image. Exploitation then requires local access to that image - for example the ability to pull it from a registry, read image layers, or access a running/stored container. Limiting factors: the attack vector is local (AV:L), not network-reachable, so the attacker must already be able to obtain the built image; impact is confined to disclosure of whatever sensitive files happened to reside in the build context (C:H, no integrity or availability impact). No authentication against the application itself is needed (PR:N), and no user interaction is required.

This is a genuine but low-urgency issue. The vendor CVSS of 6.2 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) is driven almost entirely by the C:H confidentiality impact; the AV:L attack vector caps real-world reach because exploitation requires local access to the produced container image, not a network-facing endpoint. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so this is 'no public exploit identified at time of analysis' - not active exploitation. No SSVC decision data is provided. The description's phrase 'local attacker' is consistent with the AV:L vector, so signals are internally coherent (no CVSS-vs-description conflict). Note the PR:N/local combination is unusual: it reflects that anyone able to read/pull the built image obtains the baked-in secrets without needing credentials on the app itself. Bottom line: a real weakness (secrets leaking into container images) but a moderate, not urgent, priority given local vector, no exploitation signals, and an available vendor patch.

A build pipeline for IBM Concert recursively copies the entire build context directory into the container image, embedding sensitive files (e.g., credentials, keys, config) that were not meant to ship. A local attacker - or anyone with access to the image registry or a running container - inspects the image layers and extracts those secrets. No public PoC exists; the attack is trivial (image layer inspection) once the image is obtainable.