CVE-2026-2477 PUBLISHED

Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge

Assigner: ibm
Reserved: 13.02.2026 Published: 08.11.2026 Updated: 08.11.2026

IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 fails to enforce backend authorization checks, allowing low‑privileged users to directly invoke administrative API endpoints. This bypasses UI‑level access restrictions and may lead to unauthorized execution of privileged functions.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS Score: 6.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	IBM
Product	watsonx Orchestrate Cartridge for Cloud Pak for Data
Versions	affected from 4.8.4 to 4.8.5 (incl.) affected from 5.0.0 to 5.4.2 (incl.)

Solutions

IBM strongly recommends addressing the vulnerability now by upgrading to IBM watsonx Orchestrate Cartridge 5.4.4

https://www.ibm.com/docs/en/watsonx/watson-orchestrate/current?topic=installing-watsonx-orchestrate-premises

References

https://www.ibm.com/support/pages/node/7293785

Problem Types

CWE-862 Missing Authorization CWE