Threats affecting pkg:maven/com.ibm/watsonx-orchestrate-cartridge-for-cloud-pak-for-data

CVE-2026-2700 is an improper access control vulnerability in IBM watsonx Orchestrate Cartridge for Cloud Pak for Data versions 4.8.4 through 4.8.5 and 5.0.0 through 5.4.2. It allows low-privileged users to execute administrative functions by directly invoking backend APIs, bypassing UI-level access restrictions due to lack of backend role-based access control enforcement.

IBM watsonx Orchestrate Cartridge for Cloud Pak for Data versions 4.8.4 through 4.8.5 and 5.0.0 through 5.4.2 contain a missing authorization vulnerability. This flaw allows low-privileged users to bypass UI-level access controls and directly invoke administrative API endpoints, potentially enabling unauthorized execution of privileged functions. The vulnerability has a medium severity rating with a CVSS score of 6.5.

CVE-2025-0166 is a low-severity vulnerability in IBM watsonx Orchestrate Cartridge for Cloud Pak for Data versions 4.8.4 through 4.8.5 and 5.0.0 through 5.4.2. It involves the inclusion of sensitive source code information that could be disclosed unintentionally. The vulnerability does not impact integrity or availability and requires high privileges to exploit. No public exploits or known active exploitation have been reported.