EUVD-2026-70745
GHSA-7fwx-m87v-v8jx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Credential is network-accessible via registry, no auth required to exploit; impact is confidentiality-only (read access to private images), no integrity or availability impact.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are hardcoded in the application source code, allowing unauthorized access to the container registry. The exposed secret enables attackers to pull private container images, potentially revealing proprietary code, configuration details, and other sensitive information.
AnalysisAI
Hardcoded container registry credentials in IBM Netezza Software 11.3.0.3 through Interim Fix 002 expose a secret directly in application source code, allowing unauthenticated remote access to IBM's private container registry. An attacker who obtains the credential - likely by inspecting distributed software artifacts or container image layers - can pull private images, potentially revealing proprietary application code, embedded configuration values, and additional secrets. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires first obtaining the hardcoded credential, which is embedded in IBM Netezza Software 11.3.0.3 through Interim Fix 002 - most likely recoverable from distributed installation packages, customer-deployed container image layers, or source code artifacts. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately conveys that once the hardcoded credential is extracted from a software artifact, exploitation is straightforward - no Netezza authentication is required and the registry is reachable over the network. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply IBM's released patch as detailed in advisory https://www.ibm.com/support/pages/node/7284359; the exact fixed interim fix level should be confirmed from that page, as the input data does not specify a precise remediated version number. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running IBM Netezza 11.3.0.3 through IF 002 and review container registry access logs for unexpected image pulls or authentication activity during the exposure window. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Netezza Software
View allIBM Netezza Software 11.3.0.3 through Interim Fix 002 omits the AWS S3 `ExpectedBucketOwner` validation parameter on S3
Improper TLS certificate validation in IBM Netezza Software 11.3.0.3 through Interim Fix 002 leaves encrypted connection
Log injection in IBM Netezza Software 11.3.0.3 through Interim Fix 002 allows unauthenticated remote attackers to insert
Improper TLS certificate validation in IBM Netezza Software 11.3.0.3 through Interim Fix 002 (CWE-297) exposes encrypted
Same weakness CWE-522 – Insufficiently Protected Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today