CVE-2026-110282

Genius Hub failed to enforce an access restriction

IBM · Db2 Genius Hub administration console

First documented disclosure · Review checkpoint

Summary

A remote authenticated user could bypass an access restriction in the AI-assisted database operations console.

Severity and exploitation evidence

Medium · 6.5/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed sources describe the vulnerability and its conditions. They do not identify malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

IBM classifies the issue as improper access control without identifying the resource or operation.

Conditions required

A low-privilege user can reach the affected console over the network.

Potential impact

IBM assesses high integrity impact. It does not disclose the affected resource.

Affected versions and configurations

1.1.2, 1.1.3, 1.1.4 and 1.1.5.

Fix and mitigation status

1.1.6.

Practical next steps

Upgrade Db2 Genius Hub to 1.1.6. IBM lists no workaround.

Operating lesson

Apply and test authorization at the resource being accessed.

Evidence and limits

This is a first-party console flaw in IBM’s Genius Hub and Agentics bulletin. IBM does not attribute it to model behavior.

Sources