Access Control Flaw in IBM Watsonx Orchestrate Cartridge for Cloud Pak for Data
CVE-2026-2700

4.3MEDIUM

Key Information:

Vendor

IBM
Status
Watsonx Orchestrate Cartridge For Cloud Pak For Data
Vendor
CVE Published:
8 November 2026

What is CVE-2026-2700?

The IBM Watsonx Orchestrate Cartridge for Cloud Pak for Data versions 4.8.4 to 4.8.5 and 5.0.0 to 5.4.2 presents an access control vulnerability that allows low-privileged users to perform administrative tasks by directly interacting with backend APIs. This issue arises because the system's UI-level access constraints do not adequately enforce role-based access control at the backend, leading to potential unauthorized operations.

Affected Version(s)

watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 <= 4.8.5

watsonx Orchestrate Cartridge for Cloud Pak for Data 5.0.0 <= 5.4.2

References

https://www.ibm.com/support/pages/node/7293785
vendor-advisorypatch

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.