{"id":"CVE-2026-109839","kind":"vulnerability","aliases":["CVE-2026-109839"],"related":[],"title":"IBM Db2 Genius Hub: authenticated attacker bypasses security restrictions via crypto flaw","description":"IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing initialization vector in the cryptographic algorithm.","summary":"IBM Db2 Genius Hub 1.0 uses a cryptographic algorithm without an initialization vector, which is a missing-IV weakness. A remote attacker who already has valid credentials can bypass security restrictions.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["db2-genius-hub","ibm","package"],"not_affected_if":["unauthenticated-only-access"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-16T18:17:31+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:47:51+00:00","updated_at":"2026-10-25T04:47:51+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-25T04:47:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM Db2 Genius Hub: authenticated attacker bypasses security restrictions via crypto flaw","impact":"medium","summary":"IBM Db2 Genius Hub 1.0 uses a cryptographic algorithm without an initialization vector, which is a missing-IV weakness. A remote attacker who already has valid credentials can bypass security restrictions.","category":"package","nicknames":[],"who_cares":["db2-genius-hub","ibm"],"confidence":0.4,"needs_auth":"yes","worst_case":"Authenticated attacker bypasses security restrictions on the affected Genius Hub","analyst_note":"Find the IBM security bulletin for CVE-2026-109839 to confirm the fixed version, the affected Genius Hub component, and whether the NVD entry is final.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unauthenticated-only-access"],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000521,"input_tokens":3287,"output_tokens":384,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-109839':15A,18A '-2026':14A,17A '1.0':29B,61C 'algorithm':33B,81C 'allow':63C 'alreadi':49B 'attack':6A,47B,67C 'authent':5A,66C 'bypass':7A,54B,69C 'could':62C 'credenti':52B 'crypto':11A 'cryptograph':32B,80C 'cve':13A,16A 'db2':2A,20B,26B,58C 'db2-genius-hub':19B 'due':72C 'flaw':12A 'genius':3A,21B,27B,59C 'hub':4A,22B,28B,60C 'ibm':1A,23B,25B,57C 'initi':36B,76C 'iv':43B 'miss':42B,75C 'missing-iv':41B 'packag':24B 'remot':46B,65C 'restrict':9A,56B,71C 'secur':8A,55B,70C 'use':30B 'valid':51B 'vector':37B,77C 'via':10A 'weak':44B 'without':34B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109839","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109839","severity":null,"published_at":"2026-10-16T18:17:31+00:00","modified_at":"2026-10-16T20:17:19+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}