Executive brief
IBM Db2 and Db2 Warehouse on Cloud Pak for Data are enterprise data platforms used for database management and analytics. A vulnerability in these systems could allow a user with administrative or high-level privileges to bypass security controls and perform unauthorized actions or access sensitive data. This could lead to unauthorized data modification or the exposure of confidential business information.
Technical details
IBM Db2 and Db2 Warehouse on Cloud Pak for Data (versions 4.8 through 5.3) are vulnerable to an improper token validation flaw (CWE-295). A remote attacker with high privileges could exploit this vulnerability to perform operations and obtain sensitive information outside of their intended authority. The root cause is a failure to correctly validate security tokens or certificates during authentication or authorization processes. Successful exploitation allows for unauthorized data access and integrity violations. IBM has released security bulletins and fixes to address this issue.
Affected products
- IBM Db2 on Cloud Pak for Data 4.8, 5.0, 5.1, 5.2, 5.3
- IBM Db2 Warehouse on Cloud Pak for Data 4.8, 5.0, 5.1, 5.2, 5.3
Timeline
- 2026-06-22: disclosed: Initial publication of the vulnerability advisory