# CVE-2026-15091: IBM Engineering AI Hub cross-site scripting

Source: https://junglewise.ai/threats/cve-2026-15091-ibm-engineering-ai-hub-cross-site-scripting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-17. Updated: 2026-07-17  
License: CC BY 4.0 with a link back

CVE-2026-15091 · Severity: critical · CVSS 9.3 · Published 2026-07-17

IBM Engineering AI Hub is a platform used for managing AI-driven engineering lifecycles. A critical vulnerability allows remote attackers to execute malicious scripts in a user's browser, which could lead to the theft of sensitive session data, unauthorized actions on behalf of users, or full account takeover. This occurs when the application fails to properly clean data before displaying it on a web page.

Technologies: [IBM Engineering AI Hub](https://junglewise.ai/threats/technologies/engineering-ai-hub). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-15091 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15091 being exploited in the wild.

**How severe is CVE-2026-15091?** Critical severity, with a CVSS score of 9.3, published 17 July 2026.

**Which products and versions are affected?** IBM Engineering AI Hub 1.0.0, 1.1.0, 1.2.0.

**Is there a fix for CVE-2026-15091?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15091 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-15091?** Check whether you run IBM Engineering AI Hub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0 are vulnerable to a Cross-Site Scripting (XSS) flaw (CWE-79). The vulnerability stems from improper neutralization of user-supplied input during web page generation. A remote, unauthenticated attacker can exploit this by persuading a user to visit a malicious URL or interact with a crafted page. Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser session, potentially leading to session hijacking or data exfiltration. The issue is resolved in version 1.3.0.

## Affected products

- IBM Engineering AI Hub 1.0.0, 1.1.0, 1.2.0

## Timeline

- 2026-07-17: advisory: IBM published the security bulletin.
- 2026-07-17: disclosed: CVE-2026-15091 published to the NVD.

## References

- [https://www.ibm.com/support/pages/node/7279964](https://www.ibm.com/support/pages/node/7279964)

## Related threats

- [IBM Engineering AI Hub session token exposure in URLs](https://junglewise.ai/threats/cve-2026-15322-ibm-engineering-ai-hub-session-token-exposure-in-urls)
- [IBM Engineering AI Hub open redirect](https://junglewise.ai/threats/cve-2026-15093-ibm-engineering-ai-hub-open-redirect)
- [IBM Engineering AI Hub OS command injection](https://junglewise.ai/threats/cve-2026-15069-ibm-engineering-ai-hub-os-command-injection)