IBM watsonx Orchestrate Cartridge (CP4D) <=5.4.2 RBAC Bypass via API
CVE-2026-2700 Published on November 8, 2026
Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge
IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 allows low-privileged users to execute administrative functions by directly invoking backend APIs.As a result, UI-level access restrictions are ineffective, as the backend fails to enforce role-based access control.
Vulnerability Analysis
CVE-2026-2700 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.
Weakness Type
What is an Authorization Vulnerability?
The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVE-2026-2700 has been classified to as an Authorization vulnerability or weakness.
Products Associated with CVE-2026-2700
Want to know whenever a new CVE is published for IBM Watsonx Orchestrate Cartridge Cloud Pak Data? stack.watch will email you.
Affected Versions
IBM watsonx Orchestrate Cartridge for Cloud Pak for Data:- Version 4.8.4, <= 4.8.5 is affected.
- Version 5.0.0, <= 5.4.2 is affected.