watsonx Orchestrate Cartridge CVE-2025-0166

Exploitation requires a high-privilege authenticated account on IBM watsonx Orchestrate Cartridge for Cloud Pak for Data (CVSS PR:H), affecting versions 4.8.4 through 4.8.5 and 5.0.0 through 5.4.2. There is no user-interaction requirement (UI:N) and the vector is network-reachable, but the high-privilege prerequisite is the dominant limiting factor: only an already-trusted or compromised privileged user can obtain the disclosed source code, and impact is confined to limited confidentiality (C:L, no integrity or availability effect). The exact feature, endpoint, or configuration that exposes the source code is not described in the available sources.

This is a genuinely low-priority issue, and the signals that are present are internally consistent rather than conflicting. The CVSS 3.1 base score is 2.7 (Low) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N: network-reachable and low-complexity, but gated behind high privileges (PR:H) with only limited confidentiality impact (C:L) and no integrity or availability impact. CWE-540 (information exposure through source code) matches the description of sensitive source code disclosure. There is no CISA KEV listing and no EPSS score provided, so exploitation probability cannot be quantified from the input; there is no public exploit or PoC reference in the data (no public exploit identified at time of analysis). The vuln.today decision label is 'monitor', the lowest urgency tier, which aligns with the low CVSS and the PR:H gate. The one thing to weigh is that the attacker already needs high-privilege authenticated access, which sharply reduces real-world exposure - an actor at that privilege level can typically already access much of the environment, so the marginal value of leaked source code is modest. This is a low-CVSS, low-real-risk hardening fix, not a priority. EPSS and KEV data are absent (not an error for a low-severity IBM-reported flaw); patch exists and should be applied on routine cycles.

An attacker who already holds high-privilege authenticated access to a watsonx Orchestrate Cartridge deployment on Cloud Pak for Data issues requests that return sensitive source code information intended to be hidden, then reviews that disclosed code for secrets or logic that could aid further attacks. No public exploit or PoC is identified, and the high-privilege requirement (PR:H) means only an already-trusted or already-compromised account can trigger it.