CVE-2026-2477

MediumCVSS 6.5/10Last modified Nov 8, 2026

Description

IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 fails to enforce backend authorization checks, allowing low‑privileged users to directly invoke administrative API endpoints. This bypasses UI‑level access restrictions and may lead to unauthorized execution of privileged functions.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
IBM	watsonx Orchestrate Cartridge for Cloud Pak for Data	>= 4.8.4, <= 4.8.5; >= 5.0.0, <= 5.4.2

References

https://www.ibm.com/support/pages/node/7293785

Timeline

Published: Nov 8, 2026
Last modified: Nov 8, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-247709.8RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In version 0.23.1 and possibly earlier versions, the MinerU parser co CVE-2026-247714.7Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, a Cross-Site Scripting (XSS) CVE-2026-247729.0OpenProject is an open-source, web-based project management software. To enable the real time collaboration on documents, OpenProject 17.0 i CVE-2026-247737.5The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, an Insecure Direct O CVE-2026-247744.3The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a business logic vul CVE-2026-247757.3OpenProject is an open-source, web-based project management software. In the new editor for collaborative documents based on BlockNote, Open CVE-2026-247764.3OpenProject is an open-source, web-based project management software. Prior to 17.0.2, the drag&drop handler moving an agenda item to a diff CVE-2026-247776.7OpenProject is an open-source, web-based project management software. Prior to 17.0.2, users with the Manage Users permission can lock and u CVE-2026-247786.1Ghost is an open source content management system. In Ghost versions 5.43.0 through 5.12.04 and 6.0.0 through 6.14.0, an attacker was able t CVE-2026-247797.1vLLM is an inference and serving engine for large language models (LLMs). Prior to version 0.14.1, a Server-Side Request Forgery (SSRF) vuln CVE-2026-247808.8AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workfl CVE-2026-247819.8vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability through the inspect