IBM Db2 on Cloud Pak for Data 4.8-5.3 Privileged Token Validation Flaw
CVE-2025-2669 Published on June 22, 2026
Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.
IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, 5.3 could allow a privileged user to perform operations and obtain sensitive information outside of their authority due to improper token validation.
Vulnerability Analysis
CVE-2025-2669 can be exploited with network access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a high impact on integrity, and a small impact on availability.
Weakness Type
Improper Certificate Validation
The software does not validate, or incorrectly validates, a certificate. When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The software might connect to a malicious host while believing it is a trusted host, or the software might be deceived into accepting spoofed data that appears to originate from a trusted host.
Products Associated with CVE-2025-2669
stack.watch emails you whenever new vulnerabilities are published in IBM Db2 On Cloud Pak For Data or IBM Db2 Warehouse On Cloud Pak Data. Just hit a watch button to start following.
Affected Versions
IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data:- Version 4.8.0 is affected.
- Version 5.0.0, <= 5.3.0 is affected.