CVE-2025-0166

Source code could be disclosed by the watsonx Orchestrate cartridge

IBM · watsonx Orchestrate with watsonx Assistant Cartridge

First documented disclosure · Review checkpoint

Summary

An authorized network user could obtain source code that IBM says should be inaccessible.

Severity and exploitation evidence

Low · 2.7/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public disclosures do not report exploitation in the wild.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Access restrictions on sensitive source material were insufficient. IBM does not identify the file or endpoint.

Conditions required

IBM’s CVSS vector requires a network connection and an account with high privileges.

Potential impact

Sensitive source code could be disclosed. IBM assesses low confidentiality impact.

Affected versions and configurations

IBM lists 4.8.4 through 4.8.5 and 5.0.0 through 5.4.2.

Fix and mitigation status

5.4.4.

Practical next steps

Upgrade to watsonx Orchestrate Cartridge 5.4.4. IBM lists no workaround.

Operating lesson

Keep source material outside user-accessible application resources.

Evidence and limits

The bulletin does not specify what source code was exposed.

Sources