CVE-2026-105702

Genius Hub error messages exposed internal details

IBM · Db2 Genius Hub administration console

First documented disclosure · Review checkpoint

Summary

An authenticated user could obtain details about the console’s internal implementation from its error responses.

Severity and exploitation evidence

Medium · 4.3/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public disclosures do not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The console returned sensitive diagnostic details in client-visible errors.

Conditions required

An authenticated user with low privileges can reach the affected console over the network.

Potential impact

Internal implementation details could be disclosed. IBM does not identify the specific fields.

Affected versions and configurations

Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4 and 1.1.5.

Fix and mitigation status

IBM Db2 Genius Hub 1.1.6.

Practical next steps

Upgrade the console to IBM Db2 Genius Hub 1.1.6. IBM lists no workaround.

Operating lesson

Keep detailed diagnostics in access-controlled logs and return limited error information to clients.

Evidence and limits

IBM’s bulletin applies its remediation to Genius Hub and Agentics. The CNA identifies the affected component as the database administration console. Its November 8 update is supplemental assessment.

Sources