CVE-2026-15322
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Vulnerability in IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0 allows a remote attacker to obtain sensitive information due to exposure of session tokens in URLs.
Risk Assessment
An attacker can intercept session tokens, potentially leading to unauthorized system access.
Recommendation
Update IBM Engineering AI Hub to a patched version and avoid placing session tokens in URLs.
Other vulnerabilities in IBM Engineering AI Hub
See all- CVE-2026-15091Critical
IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0 do not properly neutralize input during web page generation, allowing remote attackers to execute arbitrary scripts (XSS).
- CVE-2026-15093Medium
IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0 allow a remote attacker to redirect users to malicious websites due to improper validation of user-supplied URLs.
- CVE-2026-15069Medium
Vulnerability in IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0. A remote attacker can execute arbitrary script code due to improper input neutralization during web page generation (XSS).
Original NVD description (English source)
IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to obtain sensitive information due to the exposure of session tokens in URLs.