IBM watsonx.data versions 2.2 through 2.3 do not enforce restrictions on communication between pods, enabling an attacker to transfer data freely between pods. This flaw can lead to unauthorized disclosure or exfiltration of sensitive information stored in one pod to another pod, potentially compromising confidentiality of data within the cluster. The weakness is identified as CWE‑923, reflecting insufficient validation of inter‑pod interactions.

IBM watsonx.data, including all releases from 2.2.0 through 2.3.0 and any 2.3.x build. The vulnerability also applies to deployments of watsonx.data on IBM Cloud Pak for Data (CPD) version 5.3.1. Current production environments running any of these versions are therefore exposed.

The CVSS score of 5.3 indicates moderate severity. EPSS is not available, and the flaw is not listed in the CISA KEV catalog, suggesting there are currently no actively exploited incidents documented. However, the likely attack vector is a privileged or compromised user within the cluster who can target inter‑pod traffic; such an adversary could craft traffic between pods to move data without restriction. The absence of external triggers makes exploitation unlikely from the outside, but any internal user with sufficient access could exploit this weakness. Applying the vendor’s patch remains the most effective mitigation.