CVE-2026-2477 · Vendor
NO FIX YET · SEE WHAT TO DO
IBM watsonx Orchestrate Cartridge for Cloud Pak for Data fails to check authorization on the backend, so low-privileged users can call administrative API endpoints directly. This bypasses the access restrictions shown in the user interface and can allow privileged functions to run without authorization.
first public Nov 8, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running the IBM watsonx Orchestrate cartridge on IBM Cloud Pak for Data in the affected version ranges are exposed to the backend authorization gap. Deployments outside those ranges are not listed as affected. The sources do not say what the required low-privileged account role is.
Not affected if version-outside-range
Who cares cloud-pak-for-data, ibm, self-hosted, watsonx-orchestrate
IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 fails to enforce backend authorization checks, allowing low‑privileged users to directly invoke administrative API endpoints. This bypasses UI‑level access restrictions and may lead to unauthorized execution of privileged functions.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.