CVE-2026-2700: Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge

Q: Who can exploit this issue?

An authenticated low-privileged user can exploit it. The attacker can directly invoke backend APIs that do not enforce the intended role-based access controls.

Q: What access does an attacker need?

The published vector indicates network access and low privileges are required, with no user interaction required. Exploitation involves calling backend APIs rather than relying on the restricted user interface.

Q: Which Cloud Pak for Data versions are identified as affected?

IBM watsonx Orchestrate Cartridge for Cloud Pak for Data versions 4.8.4 through 4.8.5 and 5.0.0 through 5.4.2 are identified as affected.

Q: What is the practical impact of the authorization failure?

A low-privileged user may execute administrative functions that should be restricted by role. The stated impact is integrity-related; confidentiality and availability impact are not identified in the supplied severity vector.

Published Oct 23, 2026

Updated

IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 allows low-privileged users to execute administrative functions by directly invoking backend APIs.As a result, UI-level access restrictions are ineffective, as the backend fails to enforce role-based access control.

Other sources

IBM watsonx Orchestrate with watsonx Assistant Cartridge allows low-privileged users to execute administrative functions by directly invoking backend APIs.As a result, UI-level access restrictions are ineffective, as the backend fails to enforce role-based access control.

— IBM

Affected Software

2 affected components

IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data<=4.8.4-4.8.5

IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data<=5.0.0-5.4.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM watsonx Orchestrate Cartridge to a version that resolves this vulnerability.
Fixed in 5.4.4

Event History

Oct 23, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 8, 2026

CVE Published

via MITRE·06:30 PM

Data Sourced

via MITRE·06:30 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7293785

Frequently Asked Questions

Who can exploit this issue?

An authenticated low-privileged user can exploit it. The attacker can directly invoke backend APIs that do not enforce the intended role-based access controls.

What access does an attacker need?

The published vector indicates network access and low privileges are required, with no user interaction required. Exploitation involves calling backend APIs rather than relying on the restricted user interface.

Which Cloud Pak for Data versions are identified as affected?

IBM watsonx Orchestrate Cartridge for Cloud Pak for Data versions 4.8.4 through 4.8.5 and 5.0.0 through 5.4.2 are identified as affected.

What is the practical impact of the authorization failure?

A low-privileged user may execute administrative functions that should be restricted by role. The stated impact is integrity-related; confidentiality and availability impact are not identified in the supplied severity vector.

CVE-2026-2700: Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need?

Which Cloud Pak for Data versions are identified as affected?

What is the practical impact of the authorization failure?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need?

Which Cloud Pak for Data versions are identified as affected?

What is the practical impact of the authorization failure?