CVE-2026-116376

Genius Hub redirects could send users to an untrusted site

IBM · Db2 Genius Hub administration console

First documented disclosure · Review checkpoint

Summary

A link handled by the console could redirect a user to an unintended external site and support phishing.

Severity and exploitation evidence

Low · 3.4/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public disclosures do not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The redirect logic accepted a destination outside the intended trust boundary.

Conditions required

IBM describes an authenticated attacker. Its CVSS vector specifies adjacent-network access, low privileges and user interaction.

Potential impact

A user could be directed to an untrusted destination. Credential theft is a possible follow-on consequence, not an observed outcome in the bulletin.

Affected versions and configurations

Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4 and 1.1.5.

Fix and mitigation status

IBM Db2 Genius Hub 1.1.6.

Practical next steps

Upgrade the console to IBM Db2 Genius Hub 1.1.6. IBM lists no workaround.

Operating lesson

Restrict redirect destinations to expected origins and paths.

Evidence and limits

IBM’s bulletin applies its remediation to Genius Hub and Agentics. The CNA identifies the affected component as the database administration console. Its November 8 update is supplemental assessment.

Sources