CVE-2026-15093
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0 allow a remote attacker to redirect users to malicious websites due to improper validation of user-supplied URLs.
Risk Assessment
An attacker can exploit this for phishing, credential theft, or malware infection, endangering system users.
Recommendation
Upgrade IBM Engineering AI Hub to a patched version. Implement server-side URL validation and use a whitelist of allowed domains.
Other vulnerabilities in IBM Engineering AI Hub
See all- CVE-2026-15091Critical
IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0 do not properly neutralize input during web page generation, allowing remote attackers to execute arbitrary scripts (XSS).
- CVE-2026-15322High
Vulnerability in IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0 allows a remote attacker to obtain sensitive information due to exposure of session tokens in URLs.
- CVE-2026-15069Medium
Vulnerability in IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0. A remote attacker can execute arbitrary script code due to improper input neutralization during web page generation (XSS).
Original NVD description (English source)
IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to redirect users to malicious websites due to improper validation of user-supplied URLs.