IBM Db2 Cloud Pak EUVD-2025-210299

Exploitation requires an existing privileged user account on the IBM Db2 on Cloud Pak for Data or Db2 Warehouse platform - unauthenticated or low-privilege access is insufficient (PR:H per CVSS vector). The flaw is in the token validation logic within the Cloud Pak for Data orchestration layer, meaning the attacker must be authenticated and hold elevated credentials to possess or generate tokens that can be manipulated. Network access to the platform's API endpoints is required (AV:N). No user interaction is needed from a victim (UI:N). The vulnerability is most impactful in multi-tenant deployments where privilege boundaries between users or projects are security-critical; single-tenant installations where all privileged users are fully trusted face negligible practical risk. No specific non-default configuration setting is cited as a prerequisite beyond holding a privileged account.

The CVSS 3.1 base score of 6.0 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L) reflects a narrow but meaningful threat: exploitation requires an already-privileged account (PR:H), which significantly limits the attacker pool to insiders, compromised administrators, or service accounts. Despite the high integrity impact (I:H), the scope is unchanged (S:U), meaning exploitation does not pivot to other systems. No EPSS data was provided, and the absence of KEV listing and public POC places this in a low-urgency category for most organizations. However, for deployments with strict data segregation requirements - such as multi-tenant Cloud Pak for Data environments or regulated industries (finance, healthcare) - the ability of a privileged user to exceed their authorization boundary represents a real compliance and data integrity risk. The low confidentiality impact (C:L) is somewhat inconsistent with the description's reference to obtaining 'sensitive information,' suggesting partial information disclosure rather than full data exfiltration. CVSS signals and description are broadly consistent; no conflicting signals detected.

A privileged database administrator or service account on a multi-tenant IBM Db2 on Cloud Pak for Data deployment manipulates or replays an authentication token, exploiting the platform's failure to properly validate token scope. The attacker invokes administrative APIs or queries data stores outside their assigned project or namespace boundary, accessing another tenant's sensitive datasets or modifying database configurations outside their authority. No public exploit code has been identified at time of analysis, so exploitation currently requires knowledge of the token validation flaw's mechanism.