IBM Storage Scale versions 5.2.3.0 through 5.2.3.8 and 6.0.1.0 contain an improper TLS certificate validation flaw (CWE‑295) when communicating with remote cluster GUI interfaces. An attacker who can position themselves as a man‑in‑the‑middle can supply forged JSON responses, potentially allowing unauthorized configuration changes or data leakage. The flaw does not grant direct code execution but can subvert authentication and control flows within the cluster management interface.

Vulnerable releases include IBM Storage Scale 5.2.3.x up to 5.2.3.8 and IBM Storage Scale 6.0.1.x up to 6.0.1.0. IBM recommends upgrading these releases to 5.2.3.9 or newer and to 6.0.1.1 or newer, respectively, following the links provided in the vendor advisories.

With a CVSS score of 5.9 the flaw is classified as moderate. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote; the attacker must have network access between the cluster GUI and the client, typically within an internal network or on a compromised endpoint. Successful exploitation would allow the injection of forged configuration data and could compromise the integrity of the cluster.