{"id":"CVE-2026-108910","kind":"vulnerability","aliases":["CVE-2026-108910"],"related":[],"title":"IBM Db2 Genius Hub: missing cryptographic step leaks sensitive information","description":"IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to obtain sensitive information due to missing required cryptographic step.","summary":"IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 skip a required cryptographic step. A remote attacker who already has an account can obtain sensitive information.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-db2-genius-hub","other"],"not_affected_if":[],"how_to_check":"- Check the installed Db2 Genius Hub version against `1.1.2`, `1.1.3`, `1.1.4`, `1.1.5`","fix":null,"status":"open","published_at":"2026-11-04T21:17:47+00:00","first_seen_at":"2026-11-04T21:49:17+00:00","triaged_at":"2026-11-04T21:51:33+00:00","updated_at":"2026-11-04T21:51:33+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-04T21:51:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM Db2 Genius Hub: missing cryptographic step leaks sensitive information","impact":"low","summary":"IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 skip a required cryptographic step. A remote attacker who already has an account can obtain sensitive information.","audience":"businesses","category":"other","nicknames":[],"who_cares":["ibm-db2-genius-hub"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user reads sensitive information the cryptographic step should protect","analyst_note":"","how_to_check":"- Check the installed Db2 Genius Hub version against `1.1.2`, `1.1.3`, `1.1.4`, `1.1.5`\n- unknown beyond that, the sources do not say which configuration is affected","plain_action":"","needs_analyst":false,"not_affected_if":[],"who_is_affected":"Teams running IBM Db2 Genius Hub 1.1.2 through 1.1.5. The sources do not say which deployments or configurations expose the flaw, so unknown. Only authenticated remote users are described as able to trigger it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000644,"input_tokens":4126,"output_tokens":462,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-108910':13A,16A '-2026':12A,15A '1.1.2':27B,51C '1.1.3':52C '1.1.4':53C '1.1.5':29B,54C 'account':42B 'allow':56C 'alreadi':39B 'attack':37B,60C 'authent':59C 'could':55C 'cryptograph':6A,33B,69C 'cve':11A,14A 'db2':2A,19B,23B,48C 'due':65C 'genius':3A,20B,24B,49C 'hub':4A,21B,25B,50C 'ibm':1A,18B,22B,47C 'ibm-db2-genius-hub':17B 'inform':10A,46B,64C 'leak':8A 'miss':5A,67C 'obtain':44B,62C 'remot':36B,58C 'requir':32B,68C 'sensit':9A,45B,63C 'skip':30B 'step':7A,34B,70C 'version':26B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM Db2 Genius Hub 1.1.2 through 1.1.5. The sources do not say which deployments or configurations expose the flaw, so unknown. Only authenticated remote users are described as able to trigger it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ibmdb2geniushub","medium","other"],"campaign_type":null,"first_public_at":"2026-11-04T21:17:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108910","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108910","severity":null,"published_at":"2026-11-04T21:17:47+00:00","modified_at":"2026-11-04T21:17:47+00:00","first_seen_at":"2026-11-04T21:49:17+00:00","fetched_at":"2026-11-04T21:49:17+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}