IBM UrbanCode Deploy CVE-2026-10569

The attacker must hold an authenticated session on the IBM UrbanCode Deploy or DevOps Deploy instance with at least the low-privilege level required to view plugin output logs (PR:L per CVSS). The exposure is conditional on plugin steps that handle sensitive values actually writing those values into output logs - deployments using only non-sensitive parameters or properly-configured UCD secure properties with masking enabled may not expose anything actionable. The CVSS AV:N and UI:N confirm the exploit path is network-accessible and requires no victim interaction, but the PR:L authentication requirement limits exploitation to internal users or externally compromised accounts. No non-default configuration or special feature enablement is required beyond standard plugin step logging, which is on by default.

The CVSS 3.1 base score of 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N accurately characterizes the access mechanics - network-reachable, low complexity, requiring only low-privilege authentication - but the Confidentiality:Low rating may understate operational risk in environments where deployment pipelines process high-value secrets. Log viewing permissions in CI/CD platforms are routinely granted broadly to development and operations staff, expanding the realistic attacker population well beyond what PR:L implies in isolation. No EPSS data is provided in the input, limiting probabilistic exploitation assessment. The vulnerability is not listed in CISA KEV and no public proof-of-concept exists, indicating no confirmed active exploitation at time of analysis. The real-world priority is moderate-to-high for IBM-centric enterprises: the attack requires no special tools beyond authenticated log access, the patch is vendor-confirmed available, and the potential downstream impact of harvested CI/CD credentials (cloud account takeover, supply chain interference) substantially exceeds what the base CVSS score communicates.

An authenticated low-privileged user - such as a developer with permission to monitor deployment pipelines - navigates to the plugin step output log for a recent deployment that involved credential handoff or API token injection. The sensitive values appear in plaintext within the log record, allowing the user to harvest cloud provider credentials or service account tokens with no exploit tooling required. The attacker then uses the harvested credentials to access downstream cloud resources or pipeline-connected systems outside the UCD environment.