# CVE-2026-2700: IBM watsonx Orchestrate Cartridge authorization bypass

Source: https://junglewise.ai/threats/cve-2026-2700-ibm-watsonx-orchestrate-cartridge-for-cloud-pak-for-data-4-8-4  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-08. Updated: 2026-11-08  
License: CC BY 4.0 with a link back

CVE-2026-2700 · Severity: medium · CVSS 4.3 · Published 2026-11-08

IBM watsonx Orchestrate Cartridge is a component of Cloud Pak for Data that orchestrates automated workflows. Low-privileged users can bypass UI restrictions and invoke administrative backend APIs directly, allowing them to perform unauthorized system configuration changes and administrative functions. This vulnerability undermines role-based access controls at the backend level.

Technologies: [IBM watsonx Orchestrate Cartridge for Cloud Pak for Data](https://junglewise.ai/threats/technologies/watsonx-orchestrate-cartridge-for-cloud-pak-for-data). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-2700 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-2700 being exploited in the wild.

**How severe is CVE-2026-2700?** Medium severity, with a CVSS score of 4.3, published 8 November 2026.

**Which products and versions are affected?** IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, 5.0.0 through 5.4.2.

**Is there a fix for CVE-2026-2700?** Yes: fixed in 5.4.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-2700 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-2700?** Check whether you run IBM watsonx Orchestrate Cartridge for Cloud Pak for Data at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.4.4

## Technical details

The vulnerability is an improper access control flaw (CWE-284) in the backend API enforcement layer. Low-privileged authenticated users can directly invoke administrative API endpoints, bypassing UI-level authorization checks because the backend fails to properly enforce role-based access control. This requires network access and valid low-privileged credentials but no user interaction.

## Affected products

- IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, 5.0.0 through 5.4.2

## Timeline

- 2026-11-08: disclosed

## References

- [https://www.ibm.com/support/pages/node/7293785](https://www.ibm.com/support/pages/node/7293785)

## Related threats

- [IBM watsonx Orchestrate Cartridge authorization bypass in API endpoints](https://junglewise.ai/threats/cve-2026-2477-ibm-watsonx-orchestrate-cartridge-for-cloud-pak-for-data-4-8-4)
- [IBM watsonx Orchestrate Cartridge improper server-side permission trust](https://junglewise.ai/threats/cve-2025-1837-ibm-watsonx-orchestrate-cartridge-for-cloud-pak-for-data-4-8-4)