This vulnerability (CVE-2026-12085) affects IBM UrbanCode Deploy and IBM DevOps Deploy in specified versions. It involves the insertion of sensitive information into sent data (CWE-201), where authenticated users can obtain sensitive configurations and secrets through API responses. These disclosures could be leveraged in subsequent attacks against the affected system. The CVSS score of 6.5 reflects a network attack vector with low attack complexity, requiring privileges but no user interaction, and impacts confidentiality without affecting integrity or availability. No vendor advisory or patch information is available at this time.

The vulnerability allows disclosure of sensitive configuration data and secrets to authenticated users via API responses. This exposure could facilitate further attacks by providing attackers with information needed to compromise the system or escalate privileges. The impact is limited to confidentiality and does not affect system integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, organizations should monitor IBM's advisories for updates. In the meantime, restrict API access to trusted authenticated users only and review permissions to minimize exposure of sensitive information.