CVE-2026-2700 PUBLISHED

Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge

Assigner: ibm
Reserved: 18.02.2026 Published: 08.11.2026 Updated: 08.11.2026

IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 allows low-privileged users to execute administrative functions by directly invoking backend APIs.As a result, UI-level access restrictions are ineffective, as the backend fails to enforce role-based access control.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS Score: 4.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	Low	Integrity Impact	Low
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	IBM
Product	watsonx Orchestrate Cartridge for Cloud Pak for Data
Versions	affected from 4.8.4 to 4.8.5 (incl.) affected from 5.0.0 to 5.4.2 (incl.)

Solutions

IBM strongly recommends addressing the vulnerability now by upgrading to IBM watsonx Orchestrate Cartridge 5.4.4

https://www.ibm.com/docs/en/watsonx/watson-orchestrate/current?topic=installing-watsonx-orchestrate-premises

References

https://www.ibm.com/support/pages/node/7293785

Problem Types

CWE-284 Improper Access Control CWE