CVE-2026-15322 is a vulnerability in IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0, classified under CWE-598 (Use of HTTP Request With Sensitive Query String). The issue involves the exposure of session tokens within URLs, which can be intercepted or logged, leading to unauthorized access to sensitive session information. The vulnerability is remotely exploitable without authentication and requires no user interaction. The CVSS 3.1 base score is 7.5, reflecting high confidentiality impact but no impact on integrity or availability. No official remediation or patch has been announced as of the publication date.

The vulnerability allows remote attackers to obtain sensitive session tokens by intercepting URLs containing these tokens. This can lead to unauthorized access to user sessions, compromising confidentiality. There is no reported impact on integrity or availability. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing session tokens in URLs and consider alternative secure session management practices. Monitor IBM's advisories for updates on patches or mitigations.