CVE-2025-36180
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
IBM watsonx.data 2.2 through 2.3 IBM Lakehouse does not properly restrict communication between pods which could allow an attacker to transfer data between pods without restrictions.
Risk Assessment
An attacker can exploit the lack of communication restrictions between pods to perform unauthorized data transfer, potentially leading to data leakage or system integrity compromise.
Recommendation
Update IBM watsonx.data to the latest version with the fix. Also configure appropriate network policies to restrict communication between pods.
Other vulnerabilities in IBM watsonx.data
See all- CVE-2025-36145Medium
IBM watsonx.data versions 2.2 through 2.3.1 do not properly restrict inbound and outbound connections, which could allow an attacker to transfer or modify files without restrictions.
- CVE-2025-36140Medium
IBM watsonx.data versions 2.2 through 2.2.1 could allow an authenticated user to cause a denial of service through ingestion pods due to improper allocation of resources without limits.
Original NVD description (English source)
IBM watsonx.data 2.2 through 2.3 IBM Lakehouse does not properly restrict communication between pods which could allow an attacker to transfer data between pods without restrictions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS