CVE-2025-0166 PUBLISHED

Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge

Assigner: ibm
Reserved: 31.12.2024 Published: 08.11.2026 Updated: 08.11.2026

IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could disclose sensitive source code information that should not be accessible.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 2.7

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	High	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	IBM
Product	watsonx Orchestrate Cartridge for Cloud Pak for Data
Versions	affected from 4.8.4 to 4.8.5 (incl.) affected from 5.0.0 to 5.4.2 (incl.)

Solutions

IBM strongly recommends addressing the vulnerability now by upgrading to IBM watsonx Orchestrate Cartridge 5.4.4

https://www.ibm.com/docs/en/watsonx/watson-orchestrate/current?topic=installing-watsonx-orchestrate-premises

References

https://www.ibm.com/support/pages/node/7293785

Problem Types

CWE-540 Inclusion of Sensitive Information in Source Code CWE