IBM watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component update for pgjdbc

1) Improper Authentication

EUVDB-ID: #VU112166

Risk: High

CVSSv4.0: 6.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2025-49146

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to when the PostgreSQL JDBC driver is configured with channel binding set to required (default value is prefer), the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding (such as password, MD5, GSS, or SSPI authentication). A remote attacker can intercept connections that users believed were protected by channel binding requirements.

Mitigation

Install update from vendor's website.

Vulnerable software versions

watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component: 5.1.0

CPE2.3

• cpe:2.3:a:ibm_corporation:watsonx_orchestrate_with_watsonx_assistant_cartridge_-_uab_component:5.1.0:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7242040

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.