Search
Find a vulnerability
Search criteria
4 vulnerabilities found for watsonx Orchestrate Cartridge for Cloud Pak for Data by IBM
CVE-2026-2700 (GCVE-0-2026-2700)
Vulnerability from cvelistv5 – Published: 2026-11-08 18:30 – Updated: 2026-11-09 14:11
VLAI
EPSS
VEX
Title
Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge
Summary
IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 allows low-privileged users to execute administrative functions by directly invoking backend APIs.As a result, UI-level access restrictions are ineffective, as the backend fails to enforce role-based access control.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 14:11 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7293785 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | watsonx Orchestrate Cartridge for Cloud Pak for Data |
Affected:
4.8.4 , ≤ 4.8.5
(semver)
Affected: 5.0.0 , ≤ 5.4.2 (semver) cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.4:*:*:*:*:*:*:* cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.5:*:*:*:*:*:*:* cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.4.2:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-2700",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T14:11:09.398497Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T14:11:17.179Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.4:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.5:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.4.2:*:*:*:*:*:*:*"
],
"product": "watsonx Orchestrate Cartridge for Cloud Pak for Data",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "4.8.5",
"status": "affected",
"version": "4.8.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.2",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 allows low-privileged users to execute administrative functions by directly invoking backend APIs.As a result, UI-level access restrictions are ineffective, as the backend fails to enforce role-based access control.\u003c/p\u003e"
}
],
"value": "IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 allows low-privileged users to execute administrative functions by directly invoking backend APIs.As a result, UI-level access restrictions are ineffective, as the backend fails to enforce role-based access control."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T18:30:20.823Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7293785"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM strongly recommends addressing the vulnerability now by upgrading to IBM watsonx Orchestrate Cartridge 5.4.4\u003c/p\u003e\u003cp\u003e\u003ca href=\"https://www.ibm.com/docs/en/watsonx/watson-orchestrate/current?topic=installing-watsonx-orchestrate-premises\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/docs/en/watsonx/watson-orchestrate/current?topic=installing-watsonx-orchestrate-premises\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "IBM strongly recommends addressing the vulnerability now by upgrading to IBM watsonx Orchestrate Cartridge 5.4.4\n\n\n\n https://www.ibm.com/docs/en/watsonx/watson-orchestrate/current?topic=installing-watsonx-orchestrate-premises"
}
],
"title": "Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-2700",
"datePublished": "2026-11-08T18:30:20.823Z",
"dateReserved": "2026-02-18T16:34:10.020Z",
"dateUpdated": "2026-11-09T14:11:17.179Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2477 (GCVE-0-2026-2477)
Vulnerability from cvelistv5 – Published: 2026-11-08 18:29 – Updated: 2026-11-08 18:29
VLAI
EPSS
VEX
Title
Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge
Summary
IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 fails to enforce backend authorization checks, allowing low‑privileged users to directly invoke administrative API endpoints. This bypasses UI‑level access restrictions and may lead to unauthorized execution of privileged functions.
Severity
6.5 (Medium)
CWE
- CWE-862 - Missing Authorization
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7293785 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | watsonx Orchestrate Cartridge for Cloud Pak for Data |
Affected:
4.8.4 , ≤ 4.8.5
(semver)
Affected: 5.0.0 , ≤ 5.4.2 (semver) cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.4:*:*:*:*:*:*:* cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.5:*:*:*:*:*:*:* cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.4.2:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.4:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.5:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.4.2:*:*:*:*:*:*:*"
],
"product": "watsonx Orchestrate Cartridge for Cloud Pak for Data",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "4.8.5",
"status": "affected",
"version": "4.8.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.2",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 fails to enforce backend authorization checks, allowing low\u2011privileged users to directly invoke administrative API endpoints. This bypasses UI\u2011level access restrictions and may lead to unauthorized execution of privileged functions.\u003c/p\u003e"
}
],
"value": "IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 fails to enforce backend authorization checks, allowing low\u2011privileged users to directly invoke administrative API endpoints. This bypasses UI\u2011level access restrictions and may lead to unauthorized execution of privileged functions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T18:29:53.590Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7293785"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM strongly recommends addressing the vulnerability now by upgrading to IBM watsonx Orchestrate Cartridge 5.4.4\u003c/p\u003e\u003cp\u003e\u003ca href=\"https://www.ibm.com/docs/en/watsonx/watson-orchestrate/current?topic=installing-watsonx-orchestrate-premises\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/docs/en/watsonx/watson-orchestrate/current?topic=installing-watsonx-orchestrate-premises\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "IBM strongly recommends addressing the vulnerability now by upgrading to IBM watsonx Orchestrate Cartridge 5.4.4\n\n\n\n https://www.ibm.com/docs/en/watsonx/watson-orchestrate/current?topic=installing-watsonx-orchestrate-premises"
}
],
"title": "Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-2477",
"datePublished": "2026-11-08T18:29:53.590Z",
"dateReserved": "2026-02-13T16:19:24.268Z",
"dateUpdated": "2026-11-08T18:29:53.590Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-1837 (GCVE-0-2025-1837)
Vulnerability from cvelistv5 – Published: 2026-11-08 15:57 – Updated: 2026-11-09 17:09
VLAI
EPSS
VEX
Title
Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge
Summary
IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could allow an authenticated user to perform unauthorized actions due to improper trust of server-side permission methods.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 17:09 UTC
CWE
- CWE-650 - Trusting HTTP Permission Methods on the Server Side
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7293785 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | watsonx Orchestrate Cartridge for Cloud Pak for Data |
Affected:
4.8.4 , ≤ 4.8.5
(semver)
Affected: 5.0.0 , ≤ 5.4.2 (semver) cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.4:*:*:*:*:*:*:* cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.5:*:*:*:*:*:*:* cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.4.2:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-1837",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T17:09:17.662202Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T17:09:25.556Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.4:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.5:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.4.2:*:*:*:*:*:*:*"
],
"product": "watsonx Orchestrate Cartridge for Cloud Pak for Data",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "4.8.5",
"status": "affected",
"version": "4.8.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.2",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could allow an authenticated user to perform unauthorized actions due to improper trust of server-side permission methods.\u003c/p\u003e"
}
],
"value": "IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could allow an authenticated user to perform unauthorized actions due to improper trust of server-side permission methods."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-650",
"description": "CWE-650 Trusting HTTP Permission Methods on the Server Side",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T15:57:48.551Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7293785"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM strongly recommends addressing the vulnerability now by upgrading to IBM watsonx Orchestrate Cartridge 5.4.4\u003c/p\u003e\u003cp\u003e\u003ca href=\"https://www.ibm.com/docs/en/watsonx/watson-orchestrate/current?topic=installing-watsonx-orchestrate-premises\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/docs/en/watsonx/watson-orchestrate/current?topic=installing-watsonx-orchestrate-premises\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "IBM strongly recommends addressing the vulnerability now by upgrading to IBM watsonx Orchestrate Cartridge 5.4.4\n\n\n\n https://www.ibm.com/docs/en/watsonx/watson-orchestrate/current?topic=installing-watsonx-orchestrate-premises"
}
],
"title": "Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2025-1837",
"datePublished": "2026-11-08T15:57:48.551Z",
"dateReserved": "2025-03-02T12:59:10.812Z",
"dateUpdated": "2026-11-09T17:09:25.556Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-0166 (GCVE-0-2025-0166)
Vulnerability from cvelistv5 – Published: 2026-11-08 15:57 – Updated: 2026-11-09 14:15
VLAI
EPSS
VEX
Title
Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge
Summary
IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could disclose sensitive source code information that should not be accessible.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 14:14 UTC
CWE
- CWE-540 - Inclusion of Sensitive Information in Source Code
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7293785 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | watsonx Orchestrate Cartridge for Cloud Pak for Data |
Affected:
4.8.4 , ≤ 4.8.5
(semver)
Affected: 5.0.0 , ≤ 5.4.2 (semver) cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.4:*:*:*:*:*:*:* cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.5:*:*:*:*:*:*:* cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.4.2:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-0166",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T14:14:55.542618Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T14:15:09.002Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.4:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.5:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.4.2:*:*:*:*:*:*:*"
],
"product": "watsonx Orchestrate Cartridge for Cloud Pak for Data",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "4.8.5",
"status": "affected",
"version": "4.8.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.2",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could disclose sensitive source code information that should not be accessible.\u003c/p\u003e"
}
],
"value": "IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could disclose sensitive source code information that should not be accessible."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 2.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-540",
"description": "CWE-540 Inclusion of Sensitive Information in Source Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T15:57:13.892Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7293785"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM strongly recommends addressing the vulnerability now by upgrading to IBM watsonx Orchestrate Cartridge 5.4.4\u003c/p\u003e\u003cp\u003e\u003ca href=\"https://www.ibm.com/docs/en/watsonx/watson-orchestrate/current?topic=installing-watsonx-orchestrate-premises\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/docs/en/watsonx/watson-orchestrate/current?topic=installing-watsonx-orchestrate-premises\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "IBM strongly recommends addressing the vulnerability now by upgrading to IBM watsonx Orchestrate Cartridge 5.4.4\n\n\n\n https://www.ibm.com/docs/en/watsonx/watson-orchestrate/current?topic=installing-watsonx-orchestrate-premises"
}
],
"title": "Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2025-0166",
"datePublished": "2026-11-08T15:57:13.892Z",
"dateReserved": "2024-12-31T19:09:36.375Z",
"dateUpdated": "2026-11-09T14:15:09.002Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}