Executive brief
IBM DevOps Deploy (formerly UrbanCode Deploy), a tool used for automating software deployments, contains a security flaw in how it handles requests from other websites. An attacker could potentially trick a logged-in user into performing unauthorized actions or exposing sensitive information by hosting a malicious site that interacts with the deployment server. This could lead to unauthorized configuration changes or the theft of deployment-related data.
Technical details
IBM DevOps Deploy (formerly UrbanCode Deploy) versions 8.1.x and 8.2.x are vulnerable to a permissive Cross-Origin Resource Sharing (CORS) policy (CWE-942). The application fails to properly restrict the Access-Control-Allow-Origin header to trusted domains, allowing arbitrary origins to interact with the API. An unauthenticated remote attacker can exploit this by inducing a legitimate user to visit a malicious website. If the user is authenticated to the UCD server, the attacker's site can make cross-origin requests to perform actions with the user's privileges or exfiltrate sensitive data. The vulnerability is addressed in versions 8.1.2.7 and 8.2.2.0.
Affected products
- IBM DevOps Deploy / UrbanCode Deploy (UCD) 8.1 through 8.1.2.6, 8.2 through 8.2.1.0
Timeline
- 2026-06-23: advisory: Initial publication by IBM
- 2026-06-30: disclosed: NVD publication date