CVE-2026-2477: Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge
Published Oct 23, 2026
·Updated
IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 fails to enforce backend authorization checks, allowing low‑privileged users to directly invoke administrative API endpoints. This bypasses UI‑level access restrictions and may lead to unauthorized execution of privileged functions.
Affected Software
2 affected components
IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data<=4.8.4-4.8.5
IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data<=5.0.0-5.4.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM watsonx Orchestrate Cartridgeto a version that resolves this vulnerability.Fixed in 5.4.4
Event History
Oct 23, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
Affected Software
Nov 8, 2026
CVE Published
via MITRE·06:29 PM
Data Sourced
via MITRE·06:29 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·07:17 PM
DescriptionSeverityWeakness