CVE-2026-78658

MediumCVSS 6.5/10Last modified Sep 10, 2026

Description

IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.25, and 7.3 through 7.3.2.20 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.15, 8.1 through 8.1.2.8, and 8.2 through 8.2.2.1 IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an formation disclosure vulnerability when processing redacted property values. If a deployment is configured with a secure property that starts with certain non-ASCII characters, the redaction engine may fail to mask subsequent ASCII secure values embedded inside unsecure properties. An authenticated user with permissions to view deployment request details could exploit this flaw via the UI or API to view sensitive values in plain text that should otherwise be redacted.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-212

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 4, 2026
Last modified: Sep 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-786597.5When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to CVE-2026-786610.0Stack-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers. This issue affects Connext P CVE-2026-786607.5Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HT CVE-2026-786627.5Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's CVE-2026-786639.1The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for a CVE-2026-786677.5When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excess CVE-2026-786697.5A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending ma CVE-2026-78677.8A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user CVE-2026-786737.5IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper input validation.CVE-2026-786757.8GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by inclu CVE-2026-786769.8GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values CVE-2026-786777.5GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary git directories outsi