IBM Storage Scale management GUI (deploy and upgrade logging): The Storage Scale admin password is written in the clear

Impact

The Storage Scale admin password is written in the clear into GUI logs, so anyone who can read those logs - including support bundle recipients - gets the credential that controls the storage management plane.

Who can reach it

Local read access to GUI log files on a Storage Scale 5.2.3.0-5.2.3.8 or 6.0.0.0-6.0.1.0 management node, or possession of any support snap collected from one.

What to do

Apply the fix from IBM's bulletin, then rotate the admin password, purge the affected log files, and recall or destroy any support bundles already sent off site.

References

Related entries

• Linux kernel CephFS client: invalid kfree() when listing .snap directories oopses the nodeCVE-2026-23201 · Linux kernel CephFS client (parse_longname snapshot handling)Medium
• Linux perf/x86 - event pointer setup ordering in x86_pmu_enable(): A NULL pointer dereference in the x86 PMU enableCVE-2026-23435 · Linux perf/x86 - event pointer setup ordering in x86_pmu_enable()Medium
• GitLab EE: project Maintainer can open a terminal on a protected environment they are not authorized forCVE-2026-3035 · GitLab EE (protected environment terminal authorization)Medium
• Linux EDAC/mc - error path ordering in edac_mc_alloc(): When a private-data allocation fails in edac_mc_alloc()CVE-2026-31689 · Linux EDAC/mc - error path ordering in edac_mc_alloc()Medium
• Linux iommu/vt-d (dev-IOTLB flush in scalable mode): The scalable-mode half of the device-IOTLB invalidation problem —CVE-2026-43130 · Linux iommu/vt-d (dev-IOTLB flush in scalable mode)Medium
• Linux iommu/vt-d (dev-IOTLB flush for passed-through PCIe devices): The Intel IOMMU driver skips device-IOTLBCVE-2026-43161 · Linux iommu/vt-d (dev-IOTLB flush for passed-through PCIe devices)Medium