CVE-2026-110281: Multiple vulnerabilities that affects IBM Db2 Genius Hub
IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle technique.
Other sources
IBM Db2 Genius Hub improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle technique
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Db2 Genius Hubto a version that resolves this vulnerability.Fixed in 1.1.6
Event History
Frequently Asked Questions
What would an attacker need to exploit this issue?
An attacker would need to position themselves to perform a man-in-the-middle attack on TLS-protected communications involving the affected product. The vulnerability is remotely reachable and requires no privileges or user interaction, but the attack complexity is rated high.
What is the likely impact if exploitation succeeds?
A successful man-in-the-middle attack could expose sensitive information transmitted over affected TLS connections. The provided impact information indicates confidentiality impact is high, with no stated integrity or availability impact.
Which releases are identified as affected?
The affected releases identified are IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, and 1.1.5.