CVE-2026-108588: Multiple vulnerabilities that affects IBM Db2 Genius Hub

Published Nov 4, 2026

Updated

IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to a missing X-Content-Type-Options header allowing MIME type sniffing.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM Db2 Genius Hub to a version that resolves this vulnerability.
Fixed in 1.1.6

Event History

Nov 4, 2026

CVE Published

via MITRE·08:58 PM

Data Sourced

via MITRE·08:58 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

IBM Db2 Genius Hub versions 1.1.2, 1.1.3, 1.1.4, and 1.1.5 are identified as affected.

What access does an attacker need to exploit this issue?

The attacker must be remote and authenticated. No user interaction is required.

What security impact is described?

A successful attacker could bypass security restrictions because the affected application is missing the X-Content-Type-Options header, which permits MIME type sniffing. The stated impact includes low-level confidentiality and integrity effects, with no availability impact.