EUVD-2026-51275
GHSA-6vc6-wc98-c6qc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible log viewing by low-privileged authenticated users with no integrity or availability impact; confidentiality impact limited to log-visible values per CWE-200.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 is susceptible to an Exposure of Sensitive Information Vulnerability in plugin output logs. This exposure could allow an attacker with access to the logs to potentially obtain senstive values related to that step.
AnalysisAI
Plugin output logs in IBM UrbanCode Deploy and IBM DevOps Deploy expose sensitive step values to any authenticated user with log access, across a wide range of actively-maintained versions spanning both product lines. The CVSS PR:L vector confirms that a low-privileged authenticated user - such as a developer or operator - who can view deployment logs may read sensitive values such as credentials, API tokens, or configuration secrets that plugin steps emit without redaction. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the risk is practically elevated in CI/CD environments where plugin steps routinely handle high-value secrets.
Technical ContextAI
IBM UrbanCode Deploy (UCD) and its successor IBM DevOps Deploy are enterprise-grade release automation and CI/CD orchestration platforms. Plugins in these platforms execute discrete deployment steps and write their output to log records accessible through the UI and API. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause: sensitive values passed to or produced by plugin steps are written into output logs without masking or redaction, making them visible to any user with log viewing permissions. The affected CPE identifiers are cpe:2.3:a:ibm:ucd_-_ibm_urbancode_deploy and cpe:2.3:a:ibm:ucd_-_ibm_devops_deploy, confirming both product lines share the same underlying logging behavior. This class of vulnerability is particularly impactful in deployment tooling because plugin steps frequently handle cloud provider credentials, service account tokens, database passwords, and other high-value secrets as part of normal pipeline execution.
RemediationAI
Apply the vendor-released patch as directed by the IBM advisory at https://www.ibm.com/support/pages/node/7277574 - the exact patched versions for each affected release train (7.2.x, 7.3.x, 8.0.x, 8.1.x, 8.2.x) must be confirmed directly from that page, as they are not specified in the available reference data. As a compensating control pending patch application, audit and restrict log viewing permissions within UCD and DevOps Deploy to only those roles with a strict operational need; reducing the population of users who can access plugin output logs directly limits the exposure surface. Additionally, review plugin step configurations to ensure sensitive values are passed via UCD secure properties or credential stores rather than as plaintext step parameters, as properly-configured secret stores should mask values in log output. Be aware that restricting log access may impair developer troubleshooting workflows and should be coordinated with affected teams.
More in Ucd Ibm Urbancode Deploy
View allSame weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today