CVE-2026-110281

Genius Hub could accept an invalid TLS certificate

IBM · Db2 Genius Hub administration console

First documented disclosure · Review checkpoint

Summary

An attacker positioned between Genius Hub and its peer could intercept sensitive information.

Severity and exploitation evidence

Medium · 5.9/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public disclosures do not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The console did not correctly validate the peer’s TLS certificate.

Conditions required

The attacker can intercept network traffic and satisfy the conditions of IBM’s high-complexity rating. IBM’s vector requires no application privileges or user interaction.

Potential impact

Confidential information exchanged with the peer could be exposed.

Affected versions and configurations

Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4 and 1.1.5.

Fix and mitigation status

IBM Db2 Genius Hub 1.1.6.

Practical next steps

Upgrade the console to IBM Db2 Genius Hub 1.1.6. IBM lists no workaround.

Operating lesson

Require full certificate validation before sending sensitive information to another service.

Evidence and limits

IBM’s bulletin applies its remediation to Genius Hub and Agentics. The CNA identifies the affected component as the database administration console. Its November 8 update is supplemental assessment.

Sources