IBM UrbanCode Deploy EUVD-2026-71399

Exploitation requires a valid authenticated session with at minimum read/view permissions on deployment request details within IBM UrbanCode Deploy or IBM DevOps Deploy - unauthenticated external access is not possible. The specific redaction bypass is triggered only when a deployment is configured with at least one secure property whose value begins with certain non-ASCII characters; without this prerequisite configuration, the masking logic operates normally for all ASCII secure values. The vulnerability is reachable via both the web UI and the REST API. Limiting factors include: the need for authenticated credentials (insider threat or account compromise scenario), dependency on a non-ASCII-leading property being present in the target deployment, and the typical restriction of UCD/DevOps Deploy access to corporate networks or VPN-protected environments.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N scores 6.5 (Medium), with the primary mitigating factor being the PR:L requirement - an authenticated session with at minimum view-level permissions on deployment request details is necessary, ruling out unauthenticated external exploitation. The high confidentiality impact (C:H) accurately reflects that exposed values are deployment secrets such as database passwords, API keys, and service account credentials, which can enable lateral movement to downstream systems far beyond the UCD/DevOps Deploy platform itself. No EPSS data was supplied, no CISA KEV listing exists, and no public POC has been identified, so no exploit exists at time of analysis - the real-world threat is primarily from privileged insiders or compromised low-privilege accounts. The trigger condition (a non-ASCII leading character in any configured secure property) is not a universal deployment configuration, which lowers likelihood relative to the raw CVSS; however, in regulated environments or large deployment pipelines where sensitive credentials are routinely stored as secure properties, even a mid-sized municipal IT team in tczew relying on IBM UCD to orchestrate infrastructure changes should treat this as urgent given the credential-theft potential. The CVSS AC:L rating is defensible since the attacker does not need to engineer the trigger - they simply need to find a deployment where it already exists.

An authenticated user with low-privilege view access to deployment request details - such as a developer or auditor account - queries a deployment run via the IBM UCD web UI or REST API. If the deployment contains a secure property beginning with a non-ASCII character alongside other ASCII-valued secure properties embedded in non-secure property strings, the redaction engine fails and those credential values appear in plaintext in the response. The attacker records the plaintext passwords or API tokens and uses them to access databases, cloud infrastructure, or third-party services configured within the deployment pipeline.