CVE-2026-78658

IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.25, and 7.3 through 7.3.2.20 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.15, 8.1 through 8.1.2.8, and 8.2 through 8.2.2.1 IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an formation disclosure vulnerability when processing redacted property values. If a deployment is configured with a secure property that starts with certain non-ASCII characters, the redaction engine may fail to mask subsequent ASCII secure values embedded inside unsecure properties. An authenticated user with permissions to view deployment request details could exploit this flaw via the UI or API to view sensitive values in plain text that should otherwise be redacted.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7286256

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-04 16:17

Updated : 2026-09-10 21:17

NVD link : CVE-2026-78658

Mitre link : CVE-2026-78658

CVE.ORG link : CVE-2026-78658

JSON object : View

Products Affected

No product.

CWE

CWE-212

Improper Removal of Sensitive Information Before Storage or Transfer

{"id": "CVE-2026-78658", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-78658", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-10T20:38:43.014314Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:a:ibm:ucd_ibm_urbancode_deploy:7.2:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:ucd_ibm_urbancode_deploy:7.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:ucd_ibm_urbancode_deploy:7.2.3.25:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:ucd_ibm_urbancode_deploy:7.3:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:ucd_ibm_urbancode_deploy:7.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:ucd_ibm_urbancode_deploy:7.3.2.20:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "UCD - IBM UrbanCode Deploy", "versions": [{"status": "affected", "version": "7.2.0", "versionType": "semver", "lessThanOrEqual": "7.2.3.25"}, {"status": "affected", "version": "7.3.0", "versionType": "semver", "lessThanOrEqual": "7.3.2.20"}]}, {"cpes": ["cpe:2.3:a:ibm:ucd_ibm_devops_deploy:8.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:ucd_ibm_devops_deploy:8.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:ucd_ibm_devops_deploy:8.0.1.15:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:ucd_ibm_devops_deploy:8.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:ucd_ibm_devops_deploy:8.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:ucd_ibm_devops_deploy:8.1.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:ucd_ibm_devops_deploy:8.2:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:ucd_ibm_devops_deploy:8.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:ucd_ibm_devops_deploy:8.2.2.1:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "UCD - IBM DevOps Deploy", "versions": [{"status": "affected", "version": "8.0", "versionType": "semver", "lessThanOrEqual": "8.0.1.15"}, {"status": "affected", "version": "8.1.0", "versionType": "semver", "lessThanOrEqual": "8.1.2.8"}, {"status": "affected", "version": "8.2.0", "versionType": "semver", "lessThanOrEqual": "8.2.2.1"}]}]}], "published": "2026-09-04T16:17:59.823", "references": [{"url": "https://www.ibm.com/support/pages/node/7286256", "source": "psirt@us.ibm.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-212"}]}], "descriptions": [{"lang": "en", "value": "IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.25, and 7.3 through 7.3.2.20 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.15, 8.1 through 8.1.2.8, and 8.2 through 8.2.2.1 IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an formation disclosure vulnerability when processing redacted property values. If a deployment is configured with a secure property that starts with certain non-ASCII characters, the redaction engine may fail to mask subsequent ASCII secure values embedded inside unsecure properties. An authenticated user with permissions to view deployment request details could exploit this flaw via the UI or API to view sensitive values in plain text that should otherwise be redacted."}], "lastModified": "2026-09-10T21:17:46.440", "sourceIdentifier": "psirt@us.ibm.com"}