CVE-2025-36180

IBM watsonx.data 2.2 through 2.3 IBM Lakehouse does not properly restrict communication between pods which could allow an attacker to transfer data between pods without restrictions.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7270593	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ibm:watsonx.data:*:*:*:*:*:*:*:*

History

30 Sep 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) IBM watsonx.data 2.2 a 2.3 IBM Lakehouse no restringe adecuadamente la comunicación entre pods, lo que podría permitir a un atacante transferir datos entre pods sin restricciones.

Information

Published : 2026-04-30 22:16

Updated : 2026-10-07 09:10

NVD link : CVE-2025-36180

Mitre link : CVE-2025-36180

CVE.ORG link : CVE-2025-36180

JSON object : View

Products Affected

ibm

watsonx.data

CWE

CWE-923

Improper Restriction of Communication Channel to Intended Endpoints

{"id": "CVE-2025-36180", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-36180", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-01T16:07:12.084281Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:a:ibm:watsonxdata:2.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:watsonxdata:2.3.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "watsonx.data", "versions": [{"status": "affected", "version": "2.2.0", "versionType": "semver", "lessThanOrEqual": "2.3.0"}]}]}], "published": "2026-04-30T22:16:24.737", "references": [{"url": "https://www.ibm.com/support/pages/node/7270593", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-923"}]}], "descriptions": [{"lang": "en", "value": "IBM watsonx.data 2.2 through 2.3 IBM Lakehouse does not properly restrict communication between pods which could allow an attacker to transfer data between pods without restrictions."}, {"lang": "es", "value": "IBM watsonx.data 2.2 a 2.3 IBM Lakehouse no restringe adecuadamente la comunicaci\u00f3n entre pods, lo que podr\u00eda permitir a un atacante transferir datos entre pods sin restricciones."}], "lastModified": "2026-10-07T09:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:watsonx.data:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8C3A6660-2997-414D-B95A-FC33BDEE1B03", "versionEndIncluding": "2.3", "versionStartIncluding": "2.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}