Description
IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to obtain sensitive information due to the exposure of session tokens in URLs.
Published: 2026-07-17
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0 allow a remote attacker to obtain sensitive information by capturing session tokens that are improperly included in URLs. The flaw is a CWE‑598 session identifier mishandling, which exposes authentication data or other confidential information. The impact is confined to information disclosure, but it can enable further attacks once valid session tokens are known.

Affected Systems

The vulnerability affects IBM Engineering AI Hub releases 1.0.0, 1.1.0, and 1.2.0. Fixed versions are available in IBM Engineering AI Hub v1.0.01.3.0, v1.1.01.3.0, and v1.2.01.3.0 respectively.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity for information disclosure, a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, via crafted URLs that embed session tokens, possibly delivered through phishing or other social engineering techniques. No special conditions are required other than the ability to observe or request URLs containing the tokens.

Generated by OpenCVE AI on July 30, 2026 at 23:40 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now. Affected productFixed in releaseInstructionsIBM Engineering AI Hub v1.0.01.3.0 https://www.ibm.com/docs/en/engineering-ai-hub/1.3.0?topic=upgrading IBM Engineering AI Hub v1.1.01.3.0 https://www.ibm.com/docs/en/engineering-ai-hub/1.3.0?topic=upgrading IBM Engineering AI Hub v1.2.01.3.0 https://www.ibm.com/docs/en/engineering-ai-hub/1.3.0?topic=upgrading

OpenCVE Recommended Actions

  • Install the latest IBM Engineering AI Hub releases v1.0.01.3.0, v1.1.01.3.0, or v1.2.01.3.0 to eliminate the session token exposure.
  • If an upgrade cannot be performed immediately, reconfigure the application so that session tokens are never appended to URLs and are instead transmitted via secure cookies or request headers.
  • Audit authentication and session management code to enforce HttpOnly and Secure cookie flags, ensure session identifiers are generated securely, and prevent their exposure in logging or error messages.

Generated by OpenCVE AI on July 30, 2026 at 23:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 21 Jul 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 17 Jul 2026 20:00:00 +0000

Type Values Removed Values Added
Description IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to obtain sensitive information due to the exposure of session tokens in URLs.
Title Multiple Vulnerabilities in IBM Engineering AI hub.
First Time appeared Ibm
Ibm engineering Ai Hub
Weaknesses CWE-598
CPEs cpe:2.3:a:ibm:engineering_ai_hub:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:engineering_ai_hub:1.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:engineering_ai_hub:1.2.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm engineering Ai Hub
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Ibm Engineering Ai Hub
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-07-21T02:08:29.327Z

Reserved: 2026-07-09T18:13:22.722Z

Link: CVE-2026-15322

cve-icon Vulnrichment

Updated: 2026-07-21T02:08:25.278Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T23:45:05Z

Weaknesses
  • CWE-598

    Use of HTTP Request With Sensitive Query String