# CVE-2026-2477: IBM watsonx Orchestrate Cartridge authorization bypass in API endpoints

Source: https://junglewise.ai/threats/cve-2026-2477-ibm-watsonx-orchestrate-cartridge-for-cloud-pak-for-data-4-8-4  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-08. Updated: 2026-11-08  
License: CC BY 4.0 with a link back

CVE-2026-2477 · Severity: medium · CVSS 6.5 · Published 2026-11-08

IBM watsonx Orchestrate Cartridge is a business automation and integration component for IBM Cloud Pak for Data. The product fails to enforce authorization checks on backend API endpoints, allowing unprivileged users to bypass interface-level access controls and execute administrative functions they should not have permission to perform.

Technologies: [IBM watsonx Orchestrate Cartridge for Cloud Pak for Data](https://junglewise.ai/threats/technologies/watsonx-orchestrate-cartridge-for-cloud-pak-for-data). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-2477 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-2477 being exploited in the wild.

**How severe is CVE-2026-2477?** Medium severity, with a CVSS score of 6.5, published 8 November 2026.

**Which products and versions are affected?** IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4-4.8.5, 5.0.0-5.4.2.

**Is there a fix for CVE-2026-2477?** Yes: fixed in 5.4.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-2477 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-2477?** Check whether you run IBM watsonx Orchestrate Cartridge for Cloud Pak for Data at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.4.4

## Technical details

The vulnerability is a missing authorization check (CWE-862) in the backend API layer of watsonx Orchestrate Cartridge. Low-privileged authenticated users can directly invoke administrative API endpoints that lack role-based access control enforcement, bypassing UI-level restrictions. Network-based attack vector with low complexity; requires prior authentication.

## Affected products

- IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4-4.8.5, 5.0.0-5.4.2

## Timeline

- 2026-10-23: disclosed
- 2026-11-08: advisory

## References

- [https://www.ibm.com/support/pages/node/7293785](https://www.ibm.com/support/pages/node/7293785)

## Related threats

- [IBM watsonx Orchestrate Cartridge authorization bypass](https://junglewise.ai/threats/cve-2026-2700-ibm-watsonx-orchestrate-cartridge-for-cloud-pak-for-data-4-8-4)
- [IBM watsonx Orchestrate Cartridge improper server-side permission trust](https://junglewise.ai/threats/cve-2025-1837-ibm-watsonx-orchestrate-cartridge-for-cloud-pak-for-data-4-8-4)