Medium [CVE-2026-13006] Arbitrary Code Execution via Malicious Configuration or Environment Variable

ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.36 in Java applications, allows an attacker to execute arbitrary code circumventing existing protections against CVE-2025-11226 by compromising an existing logback configuration file or by injecting an environment variable before program execution.

A successful attack requires the presence of Janino library to be present on the user's class path. In addition, the attacker must have write access to a configuration file.

Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.

Please note that in logack version 1.5.37 conditional processing using Janino was removed. A flaw was found in logback-core, a logging framework for Java applications.

Red Hat severity: Moderate — CVSS 6 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). Weakness: CWE-94.

Affected products named by the advisory: Migration Toolkit for Applications 8; OpenShift Serverless; Red Hat AMQ Broker 7; Red Hat AMQ Clients; and 18 more.