CVE-2026-18513
HighCVSS 7.2Summary
The Location Service for Esri Component of IBM Maximo Application Suite versions 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition.
Risk Assessment
A schema-less CRD may allow an attacker to create or modify resources in unexpected ways, bypassing intended access restrictions.
Recommendation
Update the component to a patched version and add and enforce a schema for the Custom Resource Definition in the Kubernetes cluster.
Other vulnerabilities in IBM Maximo Application Suite - Location Service for Esri Component
See all- CVE-2026-18537High
The Location Service for Esri Component of IBM Maximo Application Suite versions 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image reference in a Kubernetes operator template.
- CVE-2026-18529High
The Location Service for Esri Component of IBM Maximo Application Suite versions 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controlled value passed to a shell command in a Kubernetes operator task.
- CVE-2026-18517High
The Location Service for Esri Component of IBM Maximo Application Suite versions 9.2, 9.1, and 9.0 is vulnerable to unintended network egress due to a misconfigured Kubernetes NetworkPolicy.
Original NVD description (English source)
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS