{"id":"CVE-2026-105702","kind":"vulnerability","aliases":["CVE-2026-105702"],"related":[],"title":"IBM Db2 Genius Hub: error messages leak internal details to logged-in users","description":"IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to obtain sensitive information due to exposure of error messages containing internal implementation details.","summary":"IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 show error messages that reveal internal implementation details. A remote attacker with a valid account can read that information, which can help plan further attacks.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-db2-genius-hub","other","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- Confirm the installed Db2 Genius Hub version, for example with the product's about page or install metadata; the affected range is `1.1.2` to `1.1.5`","fix":null,"status":"open","published_at":"2026-11-04T21:17:42+00:00","first_seen_at":"2026-11-04T21:49:17+00:00","triaged_at":"2026-11-04T21:51:32+00:00","updated_at":"2026-11-04T21:51:32+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-04T21:51:32Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"IBM Db2 Genius Hub: error messages leak internal details to logged-in users","impact":"low","summary":"IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 show error messages that reveal internal implementation details. A remote attacker with a valid account can read that information, which can help plan further attacks.","audience":"businesses","category":"other","nicknames":[],"who_cares":["ibm-db2-genius-hub","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Internal implementation details leak to an authenticated remote user","analyst_note":"","how_to_check":"- Confirm the installed Db2 Genius Hub version, for example with the product's about page or install metadata; the affected range is `1.1.2` to `1.1.5`\n- unknown","plain_action":"","needs_analyst":false,"not_affected_if":["unknown"],"who_is_affected":"Teams running IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 where users have login accounts. The sources do not say which configurations expose the error messages, so the exposure scope is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000642,"input_tokens":4132,"output_tokens":457,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-105702':17A,20A '-2026':16A,19A '1.1.2':35B,67C '1.1.3':68C '1.1.4':69C '1.1.5':37B,70C 'account':52B 'allow':72C 'attack':48B,62B,76C 'authent':75C 'contain':87C 'could':71C 'cve':15A,18A 'db2':2A,23B,31B,64C 'detail':9A,45B,90C 'due':81C 'error':5A,39B,85C 'exposur':83C 'genius':3A,24B,32B,65C 'help':59B 'host':29B 'hub':4A,25B,33B,66C 'ibm':1A,22B,30B,63C 'ibm-db2-genius-hub':21B 'implement':44B,89C 'inform':56B,80C 'intern':8A,43B,88C 'leak':7A 'log':12A 'logged-in':11A 'messag':6A,40B,86C 'obtain':78C 'plan':60B 'read':54B 'remot':47B,74C 'reveal':42B 'self':28B 'self-host':27B 'sensit':79C 'show':38B 'user':14A 'valid':51B 'version':34B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 where users have login accounts. The sources do not say which configurations expose the error messages, so the exposure scope is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ibmdb2geniushub","medium","other","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-04T21:17:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105702","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105702","severity":null,"published_at":"2026-11-04T21:17:42+00:00","modified_at":"2026-11-04T21:17:43+00:00","first_seen_at":"2026-11-04T21:49:17+00:00","fetched_at":"2026-11-04T21:49:17+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}