{"id":"CVE-2025-0166","kind":"vulnerability","aliases":["CVE-2025-0166"],"related":[],"title":"IBM watsonx Orchestrate: flaw can expose sensitive source code information","description":"IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could disclose sensitive source code information that should not be accessible.","summary":"IBM watsonx Orchestrate Cartridge for Cloud Pak for Data versions 4.8.4 through 4.8.5 and 5.0.0 through 5.4.2 can disclose source code information that should not be accessible. An attacker can read internal code details the product should keep hidden.","severity":"low","cvss":2.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloud-pak-for-data","ibm","vendor","watsonx-orchestrate"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check the installed watsonx Orchestrate cartridge version on Cloud Pak for Data against the affected ranges 4.8.4 through 4.8.5 and 5.0.0 through 5.4.2","fix":null,"status":"open","published_at":"2026-11-08T16:16:35+00:00","first_seen_at":"2026-11-08T16:18:33+00:00","triaged_at":"2026-11-08T16:19:03+00:00","updated_at":"2026-11-08T16:19:03+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-08T16:19:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"IBM watsonx Orchestrate: flaw can expose sensitive source code information","impact":"low","summary":"IBM watsonx Orchestrate Cartridge for Cloud Pak for Data versions 4.8.4 through 4.8.5 and 5.0.0 through 5.4.2 can disclose source code information that should not be accessible. An attacker can read internal code details the product should keep hidden.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["watsonx-orchestrate","cloud-pak-for-data","ibm"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Sensitive source code information is readable by an attacker","analyst_note":"Confirm the fixed version and the access needed to trigger the disclosure from the IBM security bulletin for CVE-2025-0166.","how_to_check":"- Check the installed watsonx Orchestrate cartridge version on Cloud Pak for Data against the affected ranges 4.8.4 through 4.8.5 and 5.0.0 through 5.4.2\n- unknown for other checks, the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organizations running the IBM watsonx Orchestrate Cartridge for Cloud Pak for Data in the affected version ranges. The sources do not say what configuration or access is needed to reach the disclosure, so unknown.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000748,"input_tokens":4559,"output_tokens":585,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-0166':13A,16A '-2025':12A,15A '4.8.4':37B,75C '4.8.5':39B,77C '5.0.0':41B,79C '5.4.2':43B,81C 'access':53B,92C 'attack':55B 'cartridg':30B,69C 'cloud':18B,32B,71C 'cloud-pak-for-data':17B 'code':9A,47B,59B,86C 'could':82C 'cve':11A,14A 'data':21B,35B,74C 'detail':60B 'disclos':45B,83C 'expos':6A 'flaw':4A 'hidden':65B 'ibm':1A,22B,27B,66C 'inform':10A,48B,87C 'intern':58B 'keep':64B 'orchestr':3A,26B,29B,68C 'pak':19B,33B,72C 'product':62B 'read':57B 'sensit':7A,84C 'sourc':8A,46B,85C 'vendor':23B 'version':36B 'watsonx':2A,25B,28B,67C 'watsonx-orchestr':24B","nicknames":[],"mitigations":[],"who_affected":"Organizations running the IBM watsonx Orchestrate Cartridge for Cloud Pak for Data in the affected version ranges. The sources do not say what configuration or access is needed to reach the disclosure, so unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cloudpakfordata","ibm","low","vendor","watsonxorchestrate"],"campaign_type":null,"search_a":"'-0166':13A,16A '-2025':12A,15A 'code':9A 'cve':11A,14A 'expos':6A 'flaw':4A 'ibm':1A 'inform':10A 'orchestr':3A 'sensit':7A 'sourc':8A 'watsonx':2A","search_b":"'4.8.4':37B '4.8.5':39B '5.0.0':41B '5.4.2':43B 'access':53B 'attack':55B 'cartridg':30B 'cloud':18B,32B 'cloud-pak-for-data':17B 'code':47B,59B 'data':21B,35B 'detail':60B 'disclos':45B 'hidden':65B 'ibm':22B,27B 'inform':48B 'intern':58B 'keep':64B 'orchestr':26B,29B 'pak':19B,33B 'product':62B 'read':57B 'sourc':46B 'vendor':23B 'version':36B 'watsonx':25B,28B 'watsonx-orchestr':24B","search_c":"'4.8.4':75C '4.8.5':77C '5.0.0':79C '5.4.2':81C 'access':92C 'cartridg':69C 'cloud':71C 'code':86C 'could':82C 'data':74C 'disclos':83C 'ibm':66C 'inform':87C 'orchestr':68C 'pak':72C 'sensit':84C 'sourc':85C 'watsonx':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T16:16:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-0166","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-0166","severity":null,"published_at":"2026-11-08T16:16:35+00:00","modified_at":"2026-11-08T16:16:35+00:00","first_seen_at":"2026-11-08T16:18:33+00:00","fetched_at":"2026-11-08T16:18:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}