The vulnerability identified as CVE-2026-12085 affects IBM UrbanCode Deploy and IBM DevOps Deploy across multiple versions. It involves the insertion of sensitive information into sent data (CWE-201), specifically disclosing sensitive configurations and secrets in API responses accessible to authenticated users. This information disclosure could be leveraged in subsequent attacks. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

Authenticated users can access sensitive configuration data and secrets via API responses, potentially enabling further attacks on the system. The confidentiality impact is high, but integrity and availability are not affected. This could lead to unauthorized information disclosure within affected versions of IBM UrbanCode Deploy and IBM DevOps Deploy.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor IBM's advisories for updates. Until a patch is available, restrict API access to trusted authenticated users and review permissions to minimize exposure of sensitive information.