IBM Netezza & Qiskit SDK: Six Vulnerabilities Disclosed, Including Hardcoded Credentials
Key findings • Six vulnerabilities disclosed for IBM Netezza Software and Qiskit SDK on September 3, 2026. • High severity flaw CVE-2026-8862 exposes hardcoded credentials in IBM Netezza Soft…
Key findings
- Six vulnerabilities disclosed for IBM Netezza Software and Qiskit SDK on September 3, 2026.
- High severity flaw CVE-2026-8862 exposes hardcoded credentials in IBM Netezza Software, granting container registry access.
- Multiple IBM Netezza vulnerabilities involve improper validation of S3 bucket ownership and TLS certificates.
- CVE-2026-19795 in IBM Qiskit SDK allows for denial of service via crafted QPY payloads.
- Affected IBM Netezza versions include 11.3.0.3 through Interim Fix 002.
- IBM Qiskit SDK versions 2.1.0 through 2.5.1 are impacted by a DoS vulnerability.
On September 3, 2026, a batch of six vulnerabilities was disclosed for IBM Netezza Software and IBM Qiskit SDK. The vulnerabilities, disclosed within a one-hour window, range in severity from Medium to High, with the most critical flaw allowing unauthorized access to a container registry due to hardcoded credentials.
Several vulnerabilities in IBM Netezza Software stem from improper validation. CVE-2026-9745, a Medium severity vulnerability, arises from operations performed without validating bucket ownership, potentially allowing attackers to redirect application requests to unintended S3 buckets. Similarly, CVE-2026-9744 and CVE-2026-9036, both rated Medium, involve insufficient TLS certificate validation, which could enable man-in-the-middle attacks to steal sensitive information. Another Medium severity issue, CVE-2026-9736, allows an unauthorized user to inject data into log messages due to improper neutralization of special elements.
The most severe vulnerability disclosed is CVE-2026-8862, a High severity flaw in IBM Netezza Software. This vulnerability involves hardcoded credentials within the application's source code, granting unauthorized access to the container registry. Attackers can leverage this exposure to download private container images, potentially revealing proprietary code and sensitive configuration details.
Separately, CVE-2026-19795, a Medium severity vulnerability affecting IBM Qiskit SDK versions 2.1.0 through 2.5.1, could lead to a denial of service. This is caused by improper handling of a specially crafted object during deserialization, where a malicious QPY payload can trigger a segmentation fault and crash the application when processing untrusted input.
All disclosed IBM Netezza Software vulnerabilities affect versions 11.3.0.3 through Interim Fix 002. The IBM Qiskit SDK vulnerabilities affect versions 2.1.0 through 2.5.1. Users are advised to consult IBM's security advisories for specific patching information and mitigation strategies.
This batch of vulnerabilities highlights the importance of secure coding practices, including proper credential management, input validation, and TLS certificate verification. Users of IBM Netezza Software and Qiskit SDK should prioritize applying available patches to protect against potential exploitation of these flaws. The disclosure of hardcoded credentials, in particular, underscores the risks associated with embedding sensitive information directly into source code.