CVE-2026-105991

Genius Hub omitted a browser content security policy

IBM · Db2 Genius Hub administration console

First documented disclosure · Review checkpoint

Summary

IBM reports that a missing browser policy weakened enforcement of security restrictions in the database administration console.

Severity and exploitation evidence

Low · 3.5/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public disclosures do not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Responses omitted the Content Security Policy header that the console relied on to constrain browser behavior.

Conditions required

IBM’s vector requires network access, low privileges and user interaction.

Potential impact

IBM rates the potential confidentiality impact low. Its bulletin does not identify a particular data set exposed.

Affected versions and configurations

Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4 and 1.1.5.

Fix and mitigation status

IBM Db2 Genius Hub 1.1.6.

Practical next steps

Upgrade the console to IBM Db2 Genius Hub 1.1.6. IBM lists no workaround.

Operating lesson

Verify that security-sensitive browser responses carry the intended content policy.

Evidence and limits

IBM’s bulletin applies its remediation to Genius Hub and Agentics. The CNA identifies the affected component as the database administration console. Its November 8 update is supplemental assessment.

Sources