IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.2 are vulnerable to a credential exposure flaw caused by binding the service to an unrestricted IP address. This weakness allows a remote attacker to obtain sensitive information, such as credentials or authentication data, without requiring authentication or additional privileges. The flaw is classified as CWE‑1327, improper restriction of operations within network boundaries.

The affected product is IBM App Connect Enterprise, specifically versions 13.0.1.0 to 13.0.8.2. The issue is tracked under APAR IT50100, and the fix is available in the 13.0.9.0 fix pack.

The severity score of 9.8 (Critical) indicates a high impact vulnerability, while the EPSS score of less than 1% suggests a low current exploitation probability. The flaw can be leveraged by any network actor that can reach the service's IP address, as the binding to an unrestricted address exposes the credential data directly. The vulnerability is not yet reported in CISA’s KEV catalogue, but the lack of exploitation evidence does not diminish the critical risk posed by the potential exposure of credentials.