CVE-2023-50957 is a high severity (CVSS 8.0) flaw in IBM Storage Defender Resiliency Service 2.0, where encryption keys are kept in clear text. IBM says the fix is the Connection Manager shipped with Defender 2.0.1 and newer, and it lists no workarounds. Upgrade the Connection Manager.
What's affected
IBM's bulletin lists IBM Storage Defender Resiliency Service 2.0 (2.0.0) as affected. The NVD record says a privileged user could perform unauthorized actions after obtaining encrypted data from clear text key storage.
Per the bulletin, the fix is the Connection Manager included with Defender 2.0.1 and newer. For a Connection Manager that came from Defender 2.0, IBM recommends contacting support for upgrade assistance. The bulletin lists no workarounds or mitigations.
CVSS for this entry is 8.0 (High) with vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H.
How to check if you're exposed
Identify the Connection Manager instances in your environment and the Defender version each came from. Anything installed from 2.0 is in scope. IBM's bulletin is the place to confirm the exact upgrade path, and I have not seen a version command for this product that I can vouch for.
Because the attack needs high privileges, also review who holds administrative access on the hosts that run the Connection Manager.
What to do now
- Inventory Connection Manager instances and note which Defender release each was installed from.
- Contact IBM Support for upgrade help on any instance that came from Defender 2.0, as the bulletin recommends.
- Move to the Connection Manager shipped with 2.0.1 or newer.
- Review and tighten administrative access on the hosts involved, since exploitation needs a privileged user.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests, and look the entry up in the Safeguard Gold directory to see how it is tracked.
Why it matters
CWE-312 is cleartext storage of sensitive information. Keys or secrets kept unencrypted on disk turn any read access to that disk into a credential leak. Fixes usually move the secret into a protected store or encrypt it with a key the attacker cannot reach.
Storing a key in clear text next to the data it protects defeats the point of encrypting the data. Anyone with enough access to read the key can decrypt what it guards. The vector shows a scope change and high impact on confidentiality, integrity and availability, which is why the score is high even though the attacker needs high privileges and a complex path.
Nothing in the record or the bulletin reports exploitation. The practical risk is insider or post-compromise misuse, where a foothold on a host turns into access to protected backups or services.
The record does not mark this CVE as listed in the CISA Known Exploited Vulnerabilities catalog, and no source I read reports exploitation in the wild.
Quick check
Why is the score high if the attacker needs high privileges?
The vector includes a scope change and high impact on all three security properties, which raises the base score despite the privilege requirement.
Is there a temporary mitigation?
IBM lists none. Upgrade the Connection Manager, and contact support if it came from Defender 2.0.
Sources
Last reviewed: 19 October 2026.
