CORS Misconfig in IBM DevOps Deploy 8.1-8.2.1.0 Enables Privileged Access
CVE-2026-12084 Published on June 30, 2026
IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to a Permissive Cross-domain Security Policy with Untrusted Domains
IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains.
Vulnerability Analysis
CVE-2026-12084 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Weakness Type
Permissive Cross-domain Policy with Untrusted Domains
The software uses a cross-domain policy file that includes domains that should not be trusted.
Products Associated with CVE-2026-12084
Want to know whenever a new CVE is published for Ucd Ibm Devops Deploy? stack.watch will email you.
Affected Versions
UCD - IBM DevOps Deploy:- Version 8.1.0, <= 8.1.2.6 is affected.
- Version 8.2.0, <= 8.2.1.0 is affected.