CVE-2026-18097: IBM Db2 Information Disclosure Vulnerability

CVE-2026-18097 Overview

CVE-2026-18097 is an information disclosure vulnerability in IBM Db2 for Linux, UNIX, and Windows. Affected versions include Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5, including DB2 Connect Server. The product writes plain text passwords into trace files, which a local authenticated attacker can read to obtain credentials. The issue is classified under [CWE-532] Insertion of Sensitive Information into Log File.

Critical Impact
A local authenticated user can retrieve plain text passwords from Db2 trace files, enabling credential theft and potential lateral movement to database accounts.

Affected Products

IBM Db2 for Linux, UNIX and Windows 11.5.0 through 11.5.9
IBM Db2 for Linux, UNIX and Windows 12.1.0 through 12.1.5
IBM DB2 Connect Server (bundled with the above versions)

Discovery Timeline

2026-08-12 - CVE-2026-18097 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-18097

Vulnerability Analysis

The vulnerability originates in the Db2 diagnostic tracing subsystem. When trace facilities are enabled, the engine records authentication-related parameters passed to internal functions. Password values are captured verbatim rather than being redacted or masked. Trace files are typically written to the instance diagnostic path and are readable by users within the Db2 administrative group and, depending on file permissions, other local accounts.

An attacker with local access to the database server can enumerate trace output and extract credentials for any account that authenticated while tracing was active. Recovered passwords may include application service accounts and administrative users, which broadens the impact beyond the initial local foothold. The confidentiality impact is high while integrity and availability are not directly affected.

Root Cause

The root cause is improper handling of sensitive data in log output, mapped to [CWE-532]. Password fields are serialized into diagnostic records without a sanitization filter. Any authentication event captured during a trace session persists the credential to disk until the trace files are rotated or purged.

Attack Vector

Exploitation requires local access and low-level privileges on the host running Db2. The attacker does not need to trigger the trace themselves; any historical trace file that captured authentication events is sufficient. No user interaction is required. See the IBM Support Page for vendor technical details.

Detection Methods for CVE-2026-18097

Indicators of Compromise

Presence of Db2 trace files (db2trc output, .trc, or .fmt files) within the instance diagnostic path (DIAGPATH) containing readable password strings.
Unexpected read access to files under the Db2 sqllib/db2dump directory by non-administrative local accounts.
Copy or exfiltration of trace files to user-writable directories or removable media.

Detection Strategies

Audit file access events on the Db2 diagnostic path and alert when non-DBA users read .trc, .fmt, or db2diag artifacts.
Scan existing trace files for regex patterns matching password keywords such as PASSWORD=, pwd=, or authPwd to identify exposed credentials.
Review Db2 configuration to determine whether tracing (db2trc on) has been enabled in production and correlate with periods of authentication activity.

Monitoring Recommendations

Forward Db2 host filesystem audit logs to a central SIEM and build detections for reads of diagnostic paths by unexpected principals.
Monitor for invocations of db2trc, db2support, and archive utilities that package diagnostic data outside authorized maintenance windows.
Track authentication anomalies for service accounts whose credentials may have been present in captured traces.

How to Mitigate CVE-2026-18097

Immediate Actions Required

Apply the fixed Db2 level referenced on the IBM Support Page for both 11.5.x and 12.1.x branches.
Disable active traces in production using db2trc off unless required for a specific support engagement.
Purge existing trace files that may contain plain text passwords and rotate any credentials that were captured while tracing was enabled.

Patch Information

IBM has published remediation guidance and fix pack availability on the IBM Support Page. Administrators should upgrade to a fix level that redacts password material from trace output for supported 11.5 and 12.1 releases.

Workarounds

Restrict filesystem permissions on the Db2 DIAGPATH so only the instance owner and required administrators can read trace files.
Enable tracing only within controlled maintenance windows and delete generated trace files immediately after collection.
Rotate passwords for any accounts that authenticated to Db2 while tracing was active on an affected version.

bash

# Disable Db2 tracing and remove existing trace artifacts
db2trc off
cd $(db2 get dbm cfg | awk '/DIAGPATH/ {print $NF}')
find . -type f \( -name '*.trc' -o -name '*.fmt' \) -exec shred -u {} \;

# Restrict permissions on the diagnostic path
chmod 700 .