Db2 Genius Hub CVE-2026-109838

Exploitation requires LOCAL access to the system running IBM Db2 Genius Hub 1.0 (AV:L) - the flaw is not remotely exploitable over a network, which is the primary limiting factor. The weakness lies in the application's improper verification of a cryptographic signature (CWE-347), consistent with a JWT signature-validation bypass per the 'Jwt Attack' tag, meaning the attacker must be able to supply or influence a token that the application then accepts despite a forged or invalid signature. Per the CVSS vector no prior authentication is required (PR:N) and no user interaction is needed (UI:N), but the local-access prerequisite and the need to interact with the token-verification code path meaningfully constrain realistic exploitation. Impact is limited to partial disclosure and partial integrity (C:L/I:L); fixed by applying the vendor patch.

This is a moderate-severity, lower-priority issue. The NVD CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, base 5.1) describes a LOCAL attack vector with low complexity and no privileges required, yielding only partial confidentiality and integrity impact and no availability impact. The 'local' vector (AV:L) is the single biggest risk-limiting factor - this is not remotely reachable over a network, which substantially narrows real-world exploitability despite PR:N. No EPSS score, CISA KEV listing, or POC indicator was supplied in the input, so there is no signal of active exploitation or public weaponization; exploitation status is therefore 'no public exploit identified at time of analysis.' The CWE-347 (improper verification of cryptographic signature) classification combined with the 'Jwt Attack' tag strongly implies a JWT/token signature-verification weakness that could let a local attacker forge or tamper with tokens to read data they should not see. Signals are internally consistent - there is no conflict between the local vector and the information-disclosure description. Note: the combination of PR:N with AV:L is unusual and worth verifying with the vendor, since many signature-verification flaws of this type in practice require some local foothold or access to a token/session to exploit.

A local attacker with access to the host running IBM Db2 Genius Hub 1.0 crafts or manipulates a JWT/cryptographic token that the application fails to properly verify, causing it to accept a forged or altered signature. This allows the attacker to read sensitive information they would otherwise be unauthorized to access. No public exploit code has been identified for this specific flaw at the time of analysis.