CVE-2026-15322 affects IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0. The vulnerability arises from the exposure of session tokens in HTTP request URLs, which can be intercepted or logged, leading to unauthorized disclosure of sensitive session information. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges or user interaction, with a high confidentiality impact but no integrity or availability impact. No official patch or remediation level has been provided by IBM as of the publication date, and no known exploits are reported in the wild.

An attacker can remotely obtain sensitive session tokens by intercepting or accessing URLs containing these tokens. This can lead to unauthorized access to user sessions or sensitive information within the IBM Engineering AI Hub environment. The confidentiality of session tokens is compromised, but there is no direct impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing session tokens in URLs and consider using alternative secure session management practices. Monitor IBM's advisories for updates on patches or official mitigations.