CVE-2026-6938: IBM® Db2® is vulnerable to authorization bypass when uploading to a remote object storage path with a special query
Published May 27, 2026
·Updated
IBM Db2 12.1.0 through 12.1.4 is vulnerable to authorization bypass when uploading to a remote object storage path with a special query.
Affected Software
4 affected components
All of the following
IBM DB2>=12.1.0<=12.1.4
Any of the following
IBM AIX
Linux Linux kernel
IBM IBM® Db2® on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data<=v4.8 v5.0v5.1v5.2v5.3
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Db2to a version that resolves this vulnerability.Fixed in 12.1.4
Event History
May 27, 2026
CVE Published
via MITRE·01:11 PM
Data Sourced
via MITRE·01:11 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·02:17 PM
DescriptionSeverityWeaknessAffected Software
Jun 19, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-6938?
CVE-2026-6938 has a high severity rating of 7.5.
2
How do I fix CVE-2026-6938?
To fix CVE-2026-6938, download the special build containing the interim fix from Fix Central for IBM Db2 version 12.1.
3
What types of attacks does CVE-2026-6938 allow?
CVE-2026-6938 allows authorization bypass, enabling potential unauthorized access to upload to a remote object storage path.
4
Which versions of IBM Db2 are affected by CVE-2026-6938?
IBM Db2 versions 12.1.0 through 12.1.4 are affected by CVE-2026-6938.
5
Can CVE-2026-6938 result in data integrity issues?
Yes, CVE-2026-6938 can lead to data integrity issues due to unauthorized modifications allowed by the authorization bypass.