# CVE-2026-12084: IBM DevOps Deploy permissive CORS policy

Source: https://junglewise.ai/threats/cve-2026-12084-ibm-devops-deploy-permissive-cors-policy  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-30. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-12084 · Severity: medium · CVSS 5.4 · Published 2026-06-30

IBM DevOps Deploy (formerly UrbanCode Deploy), a tool used for automating software deployments, contains a security flaw in how it handles requests from other websites. An attacker could potentially trick a logged-in user into performing unauthorized actions or exposing sensitive information by hosting a malicious site that interacts with the deployment server. This could lead to unauthorized configuration changes or the theft of deployment-related data.

Technologies: [IBM Urbancode Deploy](https://junglewise.ai/threats/technologies/urbancode-deploy). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-12084 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12084 being exploited in the wild.

**How severe is CVE-2026-12084?** Medium severity, with a CVSS score of 5.4, published 30 June 2026.

**Which products and versions are affected?** IBM Urbancode Deploy 8.1 through 8.1.2.6, 8.2 through 8.2.1.0.

**Is there a fix for CVE-2026-12084?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12084 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-12084?** Check whether you run IBM Urbancode Deploy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

IBM DevOps Deploy (formerly UrbanCode Deploy) versions 8.1.x and 8.2.x are vulnerable to a permissive Cross-Origin Resource Sharing (CORS) policy (CWE-942). The application fails to properly restrict the Access-Control-Allow-Origin header to trusted domains, allowing arbitrary origins to interact with the API. An unauthenticated remote attacker can exploit this by inducing a legitimate user to visit a malicious website. If the user is authenticated to the UCD server, the attacker's site can make cross-origin requests to perform actions with the user's privileges or exfiltrate sensitive data. The vulnerability is addressed in versions 8.1.2.7 and 8.2.2.0.

## Affected products

- IBM DevOps Deploy / UrbanCode Deploy (UCD) 8.1 through 8.1.2.6, 8.2 through 8.2.1.0

## Timeline

- 2026-06-23: advisory: Initial publication by IBM
- 2026-06-30: disclosed: NVD publication date

## References

- [https://www.ibm.com/support/pages/node/7277575](https://www.ibm.com/support/pages/node/7277575)

## Related threats

- [IBM UrbanCode Deploy information disclosure in property redaction](https://junglewise.ai/threats/cve-2026-78658-ibm-urbancode-deploy-information-disclosure-in-property-redaction)
- [IBM UrbanCode Deploy sensitive information disclosure in plugin logs](https://junglewise.ai/threats/cve-2026-10569-ibm-urbancode-deploy-sensitive-information-disclosure-in-plugin)
- [IBM UrbanCode Deploy sensitive information disclosure in log files](https://junglewise.ai/threats/cve-2026-12086-ibm-urbancode-deploy-sensitive-information-disclosure-in-log)