CVE-2026-78658

IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.25, and 7.3 through 7.3.2.20 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.15, 8.1 through 8.1.2.8, and 8.2 through 8.2.2.1 IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an formation disclosure vulnerability when processing redacted property values. If a deployment is configured with a secure property that starts with certain non-ASCII characters, the redaction engine may fail to mask subsequent ASCII secure values embedded inside unsecure properties. An authenticated user with permissions to view deployment request details could exploit this flaw via the UI or API to view sensitive values in plain text that should otherwise be redacted.

Scoring

Severity

MEDIUM

CVSS base score

6.5

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS probability

0.27%

CWE

CWE-212

Published

2026-09-04

Last modified

2026-09-10

Affected products

• IBM UCD - IBM UrbanCode Deploy
• IBM UCD - IBM UrbanCode Deploy
• IBM UCD - IBM DevOps Deploy
• IBM UCD - IBM DevOps Deploy
• IBM UCD - IBM DevOps Deploy

Weakness type

• CWE-212

Related vulnerabilities

• CVE-2026-86740 — Snipe-IT before 8.7.0 Attachment Deletion Reports Success While File Remains
• CVE-2026-82069 — Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster Router
• CVE-2026-53604 — nebula-mesh: CA private key not zeroized on web mobile-bundle error paths
• CVE-2026-85094 — The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin...
• CVE-2026-62900 — .NET Information Disclosure Vulnerability
• CVE-2024-5300 — AppArmor Base Profile Misconfiguration in snapd Permits Confined Snaps Unauthorized Access to Hashed Passwords via systemd-userdbd
• CVE-2026-15811 — Kronosnet: kronosnet: encryption key exposure in memory after cryptographic configuration changes
• CVE-2026-16104 — Keycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only admins

Markdown version · Browse all CVEs