CVE-2026-78658 Overview
CVE-2026-78658 is an information disclosure vulnerability affecting IBM UrbanCode Deploy (UCD) and IBM DevOps Deploy. The flaw resides in the redaction engine that masks secure property values during deployment request processing. When a secure property begins with certain non-ASCII characters, the engine fails to redact subsequent ASCII secure values embedded in unsecure properties. An authenticated user with permission to view deployment request details can retrieve sensitive values in plain text through the UI or API. The vulnerability is tracked under [CWE-212]: Improper Removal of Sensitive Information Before Storage or Transfer.
Critical Impact
Authenticated users with deployment viewing rights can read secrets, credentials, and API keys that should be masked, undermining the confidentiality guarantees of secure properties.
Affected Products
- IBM UrbanCode Deploy 7.2 through 7.2.3.25
- IBM UrbanCode Deploy 7.3 through 7.3.2.20
- IBM DevOps Deploy 8.0 through 8.0.1.15, 8.1 through 8.1.2.8, and 8.2 through 8.2.2.1
Discovery Timeline
- 2026-09-04 - CVE-2026-78658 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-78658
Vulnerability Analysis
IBM UrbanCode Deploy allows administrators to mark deployment properties as secure so their values are redacted in logs, UI views, and API responses. The redaction engine scans property values and replaces sensitive content with masked placeholders before presenting deployment request details to users.
The vulnerability arises because the redaction logic mishandles secure property values that begin with certain non-ASCII characters. When such a property exists in a deployment, the engine's parsing state becomes inconsistent. Subsequent ASCII secure values embedded inside unsecure properties are skipped by the masking routine and returned in plain text.
Exploitation requires authenticated access with permission to view deployment request details. The attacker does not need administrative privileges, only visibility into deployment outputs through the standard UI or REST API endpoints.
Root Cause
The root cause is improper handling of character encoding boundaries inside the redaction engine. The parser appears to advance incorrectly when it encounters leading non-ASCII bytes, causing it to miss secure value markers later in the property stream. This is a classic instance of [CWE-212], where sensitive information is not fully removed before transfer to a lower-trust user context.
Attack Vector
The attack vector is network-based and requires authentication. An adversary with a valid low-privilege account queries the deployment request details endpoint through the UCD web UI or REST API. If any secure property in the target deployment starts with a triggering non-ASCII character, the API response exposes other secure ASCII values in cleartext. No user interaction and no elevated privileges are required beyond deployment read access.
No public proof-of-concept exploit is available, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. See the IBM Support Page for vendor-specific technical detail.
Detection Methods for CVE-2026-78658
Indicators of Compromise
- Unusual volume of GET requests to UCD deployment request detail endpoints from a single authenticated account.
- API queries specifically targeting deployments known to contain secure properties with non-ASCII prefixes.
- Access patterns from accounts that historically do not review deployment output but suddenly enumerate multiple deployments.
Detection Strategies
- Audit UCD access logs for repeated reads of deployment request details, correlating user identity with permission scope.
- Review API gateway telemetry for authenticated calls to /rest/deploy/request/* endpoints and flag anomalous read volume.
- Compare current deployment property inventories against configurations that use non-ASCII characters in secure property values.
Monitoring Recommendations
- Forward UCD server and audit logs to a centralized SIEM for correlation with identity telemetry.
- Alert on privilege changes that grant deployment read access to non-operational accounts.
- Track secret rotation events and correlate them with prior UCD access by any account that may have viewed exposed values.
How to Mitigate CVE-2026-78658
Immediate Actions Required
- Upgrade to the fixed IBM UrbanCode Deploy or IBM DevOps Deploy release identified in the IBM Support Page.
- Rotate any secure property values that may have been exposed through the redaction bypass.
- Review role assignments and remove deployment read permissions from users who do not require them.
Patch Information
IBM has published fixed releases for the affected 7.2, 7.3, 8.0, 8.1, and 8.2 branches. Consult the IBM Support Page for the exact fix pack versions and download instructions applicable to your deployment.
Workarounds
- Avoid configuring secure property values that begin with non-ASCII characters until patches are applied.
- Restrict deployment request view permissions to a minimal set of trusted operators.
- Store highly sensitive credentials in an external secrets manager referenced by UCD rather than as inline secure properties.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
