CVE-2026-108536

Genius Hub could be framed by an untrusted page

IBM · Db2 Genius Hub administration console

First documented disclosure · Review checkpoint

Summary

A user could be misled into interacting with the database operations console through an untrusted interface.

Severity and exploitation evidence

Medium · 4.6/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed sources describe the vulnerability and its conditions. They do not identify malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The console insufficiently restricted how another page could frame or overlay its interface.

Conditions required

An authenticated remote attacker and a user interacting with the affected interface are required by IBM’s description and vector.

Potential impact

A user could trigger an unintended console action.

Affected versions and configurations

1.1.2, 1.1.3, 1.1.4 and 1.1.5.

Fix and mitigation status

1.1.6.

Practical next steps

Upgrade Db2 Genius Hub to 1.1.6. IBM lists no workaround.

Operating lesson

Check framing restrictions on every authenticated administrative interface.

Evidence and limits

This is a first-party console flaw in IBM’s Genius Hub and Agentics bulletin. IBM does not attribute it to model behavior.

Sources