---
id: "CVE-2026-2700"
page: "https://infrastack.ai/live/CVE-2026-2700"
kind: "vulnerability"
aliases: ["CVE-2026-2700"]
title: "IBM watsonx Orchestrate on Cloud Pak for Data: low-privileged users reach admin functions"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["cloud-pak-for-data", "ibm", "infrastructure", "self-hosted", "watsonx-orchestrate"]
not_affected_if: ["outside-affected-versions"]
published_at: "2026-11-08T19:17:39+00:00"
first_seen_at: "2026-11-08T19:22:34+00:00"
updated_at: "2026-11-08T19:23:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2700", "first_seen_at": "2026-11-08T19:22:34+00:00"}]
exploit_sources: []
---

# IBM watsonx Orchestrate on Cloud Pak for Data: low-privileged users reach admin functions

Link for people: https://infrastack.ai/live/CVE-2026-2700 (this .md is for agents)

IBM watsonx Orchestrate Cartridge for Cloud Pak for Data versions 4.8.4 through 4.8.5 and 5.0.0 through 5.4.2 fail to enforce role-based access control on their backend APIs. A low-privileged user who calls those APIs directly can run administrative functions that the user interface hides from them.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether the IBM watsonx Orchestrate Cartridge is installed on Cloud Pak for Data and note its version against the affected ranges 4.8.4 through 4.8.5 and 5.0.0 through 5.4.2.
- Check which accounts have low-privilege roles on that cartridge, since those are the accounts that could call the backend APIs.

## Timeline

- 2026-11-08T19:22:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-2700

## From the sources

IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 allows low-privileged users to execute administrative functions by directly invoking backend APIs.As a result, UI-level access restrictions are ineffective, as the backend fails to enforce role-based access control.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_