CVE-2026-2477
Awaiting Analysis
Awaiting Analysis - Queue
IBM watsonx Orchestrate Cartridge Authorization Bypass
Vulnerability report for CVE-2026-2477, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-08
Last updated on: 2026-11-08
Assigner: IBM Corporation
Description
Description
IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 fails to enforce backend authorization checks, allowing low‑privileged users to directly invoke administrative API endpoints. This bypasses UI‑level access restrictions and may lead to unauthorized execution of privileged functions.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| IBM | watsonx Orchestrate Cartridge for Cloud Pak for Data | From 4.8.4 (inc) to 4.8.5 (inc) |
| IBM | watsonx Orchestrate Cartridge for Cloud Pak for Data | From 5.0.0 (inc) to 5.4.2 (inc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
