CVE-2025-1837 PUBLISHED

Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge

Assigner: ibm
Reserved: 02.03.2025 Published: 08.11.2026 Updated: 08.11.2026

IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could allow an authenticated user to perform unauthorized actions due to improper trust of server-side permission methods.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS Score: 5.4

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	None	Integrity Impact	Low
User Interaction	Required	Availability Impact	None

CVSS 3.1

Product Status

Vendor	IBM
Product	watsonx Orchestrate Cartridge for Cloud Pak for Data
Versions	affected from 4.8.4 to 4.8.5 (incl.) affected from 5.0.0 to 5.4.2 (incl.)

Solutions

IBM strongly recommends addressing the vulnerability now by upgrading to IBM watsonx Orchestrate Cartridge 5.4.4

https://www.ibm.com/docs/en/watsonx/watson-orchestrate/current?topic=installing-watsonx-orchestrate-premises

References

https://www.ibm.com/support/pages/node/7293785

Problem Types

CWE-650 Trusting HTTP Permission Methods on the Server Side CWE