CVE-2026-1339 · Vendor
NO FIX YET
Universal Discovery and CMDB has an open redirect flaw in its UCMDB UI browser component. An attacker who gets a user to follow a crafted link can send them to a malicious site.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only classic (non-containerized) deployments of the UCMDB UI (ucmdb-browser) component within Universal Discovery and CMDB and Operations Bridge Manager are affected. Containerized deployments are not affected. Exposure requires a user to follow a link an attacker has crafted.
Not affected if containerized-deployment
Who cares cmdb, opentext, operations-bridge-manager, ucmdb, universal-discovery
No fix yet, per the sources.
An Open Redirect vulnerability has been identified in OpenText™ Universal Discovery and CMDB. The vulnerability can be exploited only if an attacker sends a specially crafted URL containing a link to a malicious resource and a user subsequently follows that link. Affected systems:
This issue affects only the classic deployment options for UCMDB UI (ucmdb-browser) component within Universal Discovery and CMDB and Operations Bridge Manager. Containerized deployment options are not affected.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.