CVE-2025-36058: IBM Workflow Information Disclosure Bug

CVE-2025-36058 Overview

CVE-2025-36058 is a Configuration Information Disclosure vulnerability affecting IBM Business Automation Workflow containers and IBM Cloud Pak for Business Automation. The vulnerability allows disclosure of sensitive configuration information through an exposed config map, potentially revealing internal system details to local attackers with low-level privileges.

Critical Impact

Local attackers with low privileges can access sensitive configuration data stored in container config maps, potentially exposing credentials, internal URLs, and system architecture details.

Affected Products

• IBM Business Automation Workflow containers 25.0.0 through 25.0.0 Interim Fix 002
• IBM Business Automation Workflow containers 24.0.1 through 24.0.1 Interim Fix 005
• IBM Business Automation Workflow containers 24.0.0 through 24.0.0 Interim Fix 006
• IBM Cloud Pak for Business Automation (affected versions)

Discovery Timeline

• 2026-01-20 - CVE CVE-2025-36058 published to NVD
• 2026-01-20 - Last updated in NVD database

Technical Details for CVE-2025-36058

Vulnerability Analysis

This vulnerability is classified under CWE-538 (Insertion of Sensitive Information into Externally-Accessible File or Directory). The core issue stems from IBM Business Automation Workflow containers storing sensitive configuration information in Kubernetes config maps that are accessible to users with local access to the container environment.

Config maps in Kubernetes are designed to store non-confidential data, yet this implementation inadvertently includes sensitive configuration details. When a local attacker with low-level privileges gains access to the container environment, they can enumerate and read these config maps, extracting potentially sensitive information such as database connection strings, API endpoints, internal service URLs, and possibly authentication tokens or credentials.

The vulnerability requires local access and low privileges, meaning the attacker must first establish a foothold within the container orchestration environment. However, once this access is obtained, no user interaction is required to exploit the vulnerability and extract sensitive data.

Root Cause

The root cause of this vulnerability lies in improper handling of sensitive configuration data within the container deployment. IBM Business Automation Workflow containers store configuration information in Kubernetes config maps without adequate access controls or data classification. Sensitive configuration parameters that should be stored in Kubernetes Secrets with appropriate RBAC restrictions are instead placed in more accessible config map resources.

This represents a violation of the principle of least privilege and secure configuration management practices, where sensitive data should be encrypted at rest and access-controlled based on the sensitivity of the information contained.

Attack Vector

The attack vector is local, requiring an attacker to have existing access to the Kubernetes cluster or container environment where IBM Business Automation Workflow is deployed. The exploitation follows this general pattern:

1. Attacker gains initial access to the Kubernetes namespace where IBM Business Automation Workflow containers are running
2. Attacker enumerates available config maps using standard Kubernetes API calls
3. Attacker reads the contents of config maps containing sensitive configuration data
4. Extracted information can be used for lateral movement, privilege escalation, or further attacks against connected systems

The vulnerability does not require special tools or sophisticated techniques—standard kubectl commands or Kubernetes API access is sufficient to exploit it once initial access is established.

Detection Methods for CVE-2025-36058

Indicators of Compromise

• Unusual read access patterns to Kubernetes config maps in IBM Business Automation Workflow namespaces
• Unexpected API calls to enumerate or retrieve config map contents from non-administrative accounts
• Anomalous authentication attempts using credentials potentially extracted from config maps
• Access logs showing config map reads from service accounts or users that typically don't require configuration access

Detection Strategies

• Monitor Kubernetes audit logs for get and list operations on config map resources within affected namespaces
• Implement RBAC policies that restrict config map access and alert on policy violations
• Deploy container runtime security solutions to detect anomalous process behavior within workflow containers
• Utilize SentinelOne's Cloud Workload Protection to monitor for suspicious Kubernetes API activity

Monitoring Recommendations

• Enable comprehensive Kubernetes audit logging with focus on resource access in IBM Business Automation Workflow namespaces
• Configure alerts for config map access by service accounts outside of normal operational patterns
• Implement network monitoring to detect potential data exfiltration following configuration exposure
• Regularly audit RBAC configurations to ensure config map access follows least-privilege principles

How to Mitigate CVE-2025-36058

Immediate Actions Required

• Apply the latest interim fixes from IBM: 25.0.0 Interim Fix 003 or later, 24.0.1 Interim Fix 006 or later, and 24.0.0 Interim Fix 007 or later
• Review and restrict RBAC permissions for config map access in affected namespaces
• Audit existing config maps for sensitive information and migrate credentials to Kubernetes Secrets where possible
• Implement network policies to limit container communication paths

Patch Information

IBM has released security guidance addressing this vulnerability. Administrators should consult the IBM Security Advisory for detailed patching instructions and download links for the appropriate interim fixes.

Organizations should prioritize patching based on exposure risk—environments with broader user access to the Kubernetes cluster should be addressed first.

Workarounds

• Implement strict Kubernetes RBAC policies limiting config map read access to only essential service accounts
• Migrate any sensitive configuration data (credentials, API keys, connection strings) from config maps to Kubernetes Secrets with appropriate encryption
• Deploy network policies to isolate IBM Business Automation Workflow namespaces from untrusted workloads
• Enable Kubernetes audit logging and monitor for unauthorized config map access attempts
• Consider using external secrets management solutions (HashiCorp Vault, AWS Secrets Manager) for sensitive configuration data

# Example: Restrict config map access via RBAC
kubectl create role baw-config-restricted \
  --verb=get,list \
  --resource=configmaps \
  --resource-name=<non-sensitive-configmaps-only> \
  -n <baw-namespace>

# Audit current RBAC bindings for config map access
kubectl auth can-i --list --namespace=<baw-namespace> | grep configmaps