---
id: "CVE-2025-0166"
page: "https://infrastack.ai/live/CVE-2025-0166"
kind: "vulnerability"
aliases: ["CVE-2025-0166"]
title: "IBM watsonx Orchestrate: flaw can expose sensitive source code information"
severity: "low"
cvss: 2.7
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["cloud-pak-for-data", "ibm", "vendor", "watsonx-orchestrate"]
not_affected_if: ["unaffected-version"]
published_at: "2026-11-08T16:16:35+00:00"
first_seen_at: "2026-11-08T16:18:33+00:00"
updated_at: "2026-11-08T16:19:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0166", "first_seen_at": "2026-11-08T16:18:33+00:00"}]
exploit_sources: []
---

# IBM watsonx Orchestrate: flaw can expose sensitive source code information

Link for people: https://infrastack.ai/live/CVE-2025-0166 (this .md is for agents)

IBM watsonx Orchestrate Cartridge for Cloud Pak for Data versions 4.8.4 through 4.8.5 and 5.0.0 through 5.4.2 can disclose source code information that should not be accessible. An attacker can read internal code details the product should keep hidden.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed watsonx Orchestrate cartridge version on Cloud Pak for Data against the affected ranges 4.8.4 through 4.8.5 and 5.0.0 through 5.4.2

## Timeline

- 2026-11-08T16:18:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-0166

## From the sources

IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could disclose sensitive source code information that should not be accessible.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_