IBM Guardium Data Protection 12.2.2 logs credential material such as secrets and API keys during rotation at INFO level by its edge-controller and edge-manager components. This logging of sensitive data can allow an attacker who has authenticated access to the environment to read logs and retrieve protected credentials, thereby enabling impersonation of services or unauthorized access to Guardium’s control plane. The flaw is a classic information‑disclosure weakness, coded as CWE‑200.

The vulnerability affects IBM Guardium Data Protection version 12.2.2 running on Linux. IBM has released a fix in version 12.2.3, which removes the logging of credential material. Identifying the impacted systems requires checking the application or container logs for the edge-controller/edge-manager components and verifying the installed Guardium version.

The CVSS score of 6.5 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that public exploitation is currently not reported. However, the attack requires an authenticated user with access to the system logs. If such access is possible, the credential exposure could be leveraged to compromise Guardium services or infiltrate other systems that rely on the exposed keys. The risk is elevated for environments where log files are not tightly restricted and container isolation is weak.