CVE-2026-12730

The record

IBM Business Automation Workflow containers and traditional 26.0.0, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 007, and 24.0.0 through 24.0.0 Interim Fix 009 IBM Business Automation Workflow fails to properly verify that the hostname matches the server certificate potentially allowing connections to an attacker-controlled server.

Affected packages

Related vulnerabilities

• CVE-2026-117666 Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster… CWE-297
• CVE-2026-66392 Apache bRPC versions before 1.18.0 validate the server certificate chain when client TLS… CWE-297
• CVE-2026-86410 A flaw in the curl command line tool's logic makes it only set SSH host verification… CWE-297
• CVE-2026-88647 A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the… CWE-297
• CVE-2026-107660 FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation… CWE-297
• CVE-2026-19553 ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if… CWE-297
• CVE-2026-91769 PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries… CWE-297
• CVE-2026-63374 AnyIO is a high level asynchronous concurrency and networking framework that works on top… CWE-297