EUVD-2026-71399
GHSA-wj23-fx8v-7598
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible via UI/API with low-privilege auth; C:H for credential exposure; no integrity or availability impact; AC:L since attacker observes existing deployment configuration without needing to manipulate it.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.25, and 7.3 through 7.3.2.20 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.15, 8.1 through 8.1.2.8, and 8.2 through 8.2.2.1 IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an formation disclosure vulnerability when processing redacted property values. If a deployment is configured with a secure property that starts with certain non-ASCII characters, the redaction engine may fail to mask subsequent ASCII secure values embedded inside unsecure properties. An authenticated user with permissions to view deployment request details could exploit this flaw via the UI or API to view sensitive values in plain text that should otherwise be redacted.
AnalysisAI
Information disclosure in IBM UrbanCode Deploy and IBM DevOps Deploy exposes sensitive deployment secrets in plaintext to authenticated users who should only see redacted values. The root cause is a character-parsing failure in the redaction engine: when a secure property value begins with certain non-ASCII characters, the masking logic fails to suppress subsequent ASCII secure values embedded within non-secure properties, rendering them visible through the UI and REST API. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session with at minimum read/view permissions on deployment request details within IBM UrbanCode Deploy or IBM DevOps Deploy - unauthenticated external access is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N scores 6.5 (Medium), with the primary mitigating factor being the PR:L requirement - an authenticated session with at minimum view-level permissions on deployment request details is necessary, ruling out unauthenticated external exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | IBM has released a patch for this vulnerability; consult the vendor advisory at https://www.ibm.com/support/pages/node/7286256 for the exact fixed build numbers per release line and upgrade procedures, as the provided data confirms patch availability but does not enumerate specific fixed version strings. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ucd Ibm Urbancode Deploy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today