IBM Maximo Application Suite – Location Service for Esri Component has a flaw that allows an attacker to execute arbitrary commands by exploiting an unsanitised container image configuration embedded in a Kubernetes operator template. The vulnerability stems from improper input validation of the image configuration parameters, which can be manipulated to inject malicious directives that the operator processes during deployment. If an attacker controls the template settings, they can instruct the system to pull arbitrary images or run arbitrary code, thereby compromising the application and potentially the underlying host.

IBM Maximo Application Suite – Location Service for Esri Component, versions 9.0.x (including 9.0.0 to 9.0), 9.1.x (9.1.0 to 9.1), and 9.2.x (9.2.0 to 9.2). The vendor provides official fixes for each line: 9.2.3, 9.1.13, and 9.0.14.

The flaw carries a CVSS score of 6.5, indicating moderate severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The attack requires the ability to alter the Kubernetes operator template, which typically implies privileged access or insufficient configuration hardening. Once exploited, the attacker can achieve code execution within the container environment, potentially gaining control over the application and the host infrastructure.