EUVD-2026-38266
GHSA-4pm6-4pwh-f3gg
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 30, 2026
Server-Side Request Forgery in IBM Watson Speech Services Cartridge (versions 4.0.0 through 5.3.1) lets an authenticated attacker coerce the system into issuing crafted requests to internal or external hosts, enabling internal network enumeration and pivoting toward follow-on attacks. The weakness lives in the embedded IBM Sterling File Gateway component used by the speech runtimes (GHSA-rr7j-v2q5-chgv). No public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and CISA SSVC marks exploitation as none, so this is a patch-priority issue rather than an emergency.
Earlier versions of this analysis (2)
Server-side request forgery in IBM Watson Speech Services Cartridge (versions 4.0.0 through 5.3.1) lets an authenticated attacker coerce the embedded IBM Sterling File Gateway component into issuing unauthorized requests on the attacker's behalf, enabling internal network enumeration and pivoting toward other services. The CVSS 3.1 base score is 8.8 with PR:L, reflecting that low-privilege authenticated access is required. There is no public exploit identified at time of analysis, and EPSS is low at 0.18% (8th percentile), with SSVC reporting no known exploitation.
Server-Side Request Forgery in IBM Watson Speech Services Cartridge allows an authenticated network attacker to send unauthorized requests from the server, enabling internal network enumeration or pivoting to secondary attacks. The vulnerability originates in the embedded IBM Sterling File Gateway component and affects all tracked versions of the Cartridge per CPE data. No public exploit code has been identified at time of analysis, and IBM has issued a fix addressed in its support advisory.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Ibm Watson Speech Services Cartridge gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L
Network-reachable SSRF needing a low-privilege account (PR:L); strong read/enumeration exposure (C:H) but only partial integrity impact and no inherent availability loss given the described enumeration/pivot outcome.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
6DescriptionCVE.org
IBM Watson Speech Services Cartridge is vulnerable to Server-Side Request Forgery (SSRF) in Sterling File Gateway, due to a flaw which may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks [GHSA-rr7j-v2q5-chgv] [CVE-2026-7253]. IBM Sterling File Gateway is used in our speech runtimes. This vulnerabilitiy has been addressed. Please read the details for remediation below.
Executive ViewAI
IBM Watson Speech Services Cartridge versions 4.0.0-5.3.1 contains a server-side request forgery vulnerability (CVSS 8.8) allowing authenticated users to enumerate internal network infrastructure and establish lateral movement pathways. This risk is heightened in environments where service accounts are shared or account credentials may be compromised. No vendor patch is currently available, requiring immediate network-level isolation and monitoring controls.
24 hours: Conduct complete inventory of Watson Speech Services Cartridge deployments; identify affected versions (4.0.0-5.3.1) and document all user accounts and service accounts with access. 7 days: Implement firewall rules restricting outbound connectivity from Watson services to only whitelisted internal hosts; enable request-level logging to detect SSRF indicators (encoded URLs, internal IP range access). 30 days: Monitor IBM security advisories for patch availability; develop and test upgrade procedure in non-production environment; schedule deployment of patched version upon release.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Deploy firewall and network segmentation rules restricting Watson Speech Services outbound access to only essential internal hosts; (2) Implement WAF or application proxy rules blocking SSRF payloads and denying requests to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16); (3) Enable comprehensive request and connection logging with monitoring for suspicious outbound activity; (4) Enforce least-privilege access controls on service accounts with periodic access reviews; (5) Restrict administrative access to the Speech Services component; (6) Disable or isolate the service if not actively required.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Exploit-DB