CVE-2026-108588

Genius Hub lacked a browser content-type protection

IBM · Db2 Genius Hub administration console

First documented disclosure · Review checkpoint

Summary

The browser could interpret a console response as a different content type from the one intended.

Severity and exploitation evidence

Medium · 5.4/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed sources describe the vulnerability and its conditions. They do not identify malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Affected responses omitted the browser protection that disables MIME sniffing.

Conditions required

The caller has low-privilege network access to the vulnerable console. IBM does not identify a particular client workflow.

Potential impact

The browser could bypass the expected handling of content. IBM rates confidentiality and integrity impact low.

Affected versions and configurations

1.1.2, 1.1.3, 1.1.4 and 1.1.5.

Fix and mitigation status

1.1.6.

Practical next steps

Upgrade Db2 Genius Hub to 1.1.6. IBM lists no workaround.

Operating lesson

Verify content-type protections on authenticated console responses.

Evidence and limits

This is a first-party console flaw in IBM’s Genius Hub and Agentics bulletin. IBM does not attribute it to model behavior.

Sources