---
id: "CVE-2026-2477"
page: "https://infrastack.ai/live/CVE-2026-2477"
kind: "vulnerability"
aliases: ["CVE-2026-2477"]
title: "IBM watsonx Orchestrate: low-privileged users can call admin API endpoints"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["cloud-pak-for-data", "ibm", "self-hosted", "vendor", "watsonx-orchestrate"]
not_affected_if: ["version-outside-range"]
published_at: "2026-11-08T19:17:39+00:00"
first_seen_at: "2026-11-08T19:22:33+00:00"
updated_at: "2026-11-08T19:23:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2477", "first_seen_at": "2026-11-08T19:22:33+00:00"}]
exploit_sources: []
---

# IBM watsonx Orchestrate: low-privileged users can call admin API endpoints

Link for people: https://infrastack.ai/live/CVE-2026-2477 (this .md is for agents)

IBM watsonx Orchestrate Cartridge for Cloud Pak for Data fails to check authorization on the backend, so low-privileged users can call administrative API endpoints directly. This bypasses the access restrictions shown in the user interface and can allow privileged functions to run without authorization.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether your Cloud Pak for Data deployment runs the watsonx Orchestrate cartridge at a version in the affected ranges (4.8.4 through 4.8.5, or 5.0.0 through 5.4.2)

## Fix

- Move to a fixed version of the watsonx Orchestrate cartridge; the sources do not name the fixed version

## Timeline

- 2026-11-08T19:22:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-2477

## From the sources

IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 fails to enforce backend authorization checks, allowing low‑privileged users to directly invoke administrative API endpoints. This bypasses UI‑level access restrictions and may lead to unauthorized execution of privileged functions.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_