Remote Info Disclosure via Session Tokens in URLs in IBM Eng AI Hub 1.0-1.2
CVE-2026-15322 Published on July 17, 2026
Multiple Vulnerabilities in IBM Engineering AI hub.
IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to obtain sensitive information due to the exposure of session tokens in URLs.
Vulnerability Analysis
CVE-2026-15322 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
Use of GET Request Method With Sensitive Query Strings
The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that requests. The query string can be saved in the browser's history, passed through Referers to other web sites, stored in web logs, or otherwise recorded in other sources. If the query string contains sensitive information such as session identifiers, then attackers can use this information to launch further attacks.
Products Associated with CVE-2026-15322
Want to know whenever a new CVE is published for IBM Engineering Ai Hub? stack.watch will email you.
Affected Versions
IBM Engineering AI Hub:- Version 1.0.0 is affected.
- Version 1.1.0 is affected.
- Version 1.2.0 is affected.