Storage Fusion Hci
Monthly
IBM Fusion (2.2.0 through 2.10.1), IBM Fusion HCI (2.2.0 through 2.10.0), and IBM Fusion HCI for watsonx (2.8.2 through 2.10.0) ship an insecure default configuration that can leave the bundled AMQStreams (Apache Kafka) broker exposed without client authentication, allowing any party with network reachability to publish, consume, or administer topics and cluster metadata without credentials - a full confidentiality, integrity, and availability impact reflected in the 9.8 base score (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-1188). No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is only 0.03% (10th percentile), so near-term exploitation likelihood is assessed as low. The practical limiting factor is exposure: AMQStreams is normally an in-cluster OpenShift component, so deployments that already require Kafka client authentication or restrict the listener to internal cluster traffic are not realistically exploitable.
IBM Fusion and IBM Fusion HCI 2.3.0 through 2.8.2 is vulnerable to insecure network connection by allowing an attacker who gains access to a Fusion container to establish an external network. Rated medium severity (CVSS 4.0), this vulnerability is no authentication required. No vendor patch available.
IBM Storage Fusion HCI 2.1.0 through 2.6.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM Fusion (2.2.0 through 2.10.1), IBM Fusion HCI (2.2.0 through 2.10.0), and IBM Fusion HCI for watsonx (2.8.2 through 2.10.0) ship an insecure default configuration that can leave the bundled AMQStreams (Apache Kafka) broker exposed without client authentication, allowing any party with network reachability to publish, consume, or administer topics and cluster metadata without credentials - a full confidentiality, integrity, and availability impact reflected in the 9.8 base score (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-1188). No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is only 0.03% (10th percentile), so near-term exploitation likelihood is assessed as low. The practical limiting factor is exposure: AMQStreams is normally an in-cluster OpenShift component, so deployments that already require Kafka client authentication or restrict the listener to internal cluster traffic are not realistically exploitable.
IBM Fusion and IBM Fusion HCI 2.3.0 through 2.8.2 is vulnerable to insecure network connection by allowing an attacker who gains access to a Fusion container to establish an external network. Rated medium severity (CVSS 4.0), this vulnerability is no authentication required. No vendor patch available.
IBM Storage Fusion HCI 2.1.0 through 2.6.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.