Description

IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.25, and 7.3 through 7.3.2.20 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.15, 8.1 through 8.1.2.8, and 8.2 through 8.2.2.1 IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an formation disclosure vulnerability when processing redacted property values. If a deployment is configured with a secure property that starts with certain non-ASCII characters, the redaction engine may fail to mask subsequent ASCII secure values embedded inside unsecure properties. An authenticated user with permissions to view deployment request details could exploit this flaw via the UI or API to view sensitive values in plain text that should otherwise be redacted.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-04T16:17:59.823Z",
  "pubdate": "2026-09-04T16:17:59.823Z",
  "executiveSummary": "This vulnerability is an information disclosure flaw affecting IBM UrbanCode Deploy (UCD) and IBM DevOps Deploy. The issue resides within the redaction engine responsible for masking sensitive property values within deployment requests.\nThe vulnerability allows an authenticated attacker to bypass security masking mechanisms, leading to the exposure of plain-text secrets. By manipulating specific property configurations to include non-ASCII characters at the start of a secure property, the redaction logic fails, causing subsequent ASCII-based secure values embedded in unsecure properties to be rendered in clear text.\nAffected versions include IBM UrbanCode Deploy 7.2 through 7.2.3.25 and 7.3 through 7.3.2.20; and IBM DevOps Deploy 8.0 through 8.0.1.15, 8.1 through 8.1.2.8, and 8.2 through 8.2.2.1.\nThe risk implication is significant as it permits unauthorized retrieval of sensitive credentials or configuration secrets. Exploitation requires authenticated access to the system with permissions to view deployment request details via the UI or API. No advanced network access beyond standard authentication is required to trigger the failure in the redaction logic.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of character encoding within the IBM UCD/IBM DevOps Deploy redaction engine. The engine is designed to intercept and mask values marked as 'secure' when they appear in deployment logs or configuration displays. However, the logic responsible for scanning and identifying these sensitive strings is sensitive to the sequence of input characters.\nWhen a secure property value is initialized with specific non-ASCII character sequences, the internal state machine of the redaction engine experiences a processing error. This error causes the engine to prematurely terminate its sanitization routine for that specific context. Because the engine fails to complete its masking pass, it treats subsequent data within the scope of the deployment request as unprivileged or standard content, failing to apply the necessary regex or masking filters to secondary secure properties embedded in unsecure fields.\nExploitation follows a specific sequence of actions by an authenticated user. First, the attacker must have the requisite permissions to trigger or view a deployment request. The attacker, or an existing configuration, ensures that a secure property is defined with a leading non-ASCII character. Following this, the attacker embeds a secondary sensitive value (such as an API key, password, or token) within a property field that is otherwise treated as 'unsecure' or standard text.\nWhen the deployment request is processed or viewed by the user, the UI or API backend retrieves the property data. Because the redaction engine has been invalidated by the initial non-ASCII input, the masking logic does not identify the secondary secure value. Consequently, the application returns the sensitive data in plain text to the requester.\nThis impact extends to any sensitive information that would normally be obscured by the platform's security controls. The disclosure is persistent as long as the underlying deployment request remains accessible. The vulnerability affects the core property-handling component of the IBM DevOps Deploy and IBM UrbanCode Deploy platforms, specifically targeting the data presentation layer where redaction is enforced.\nPost-exploitation, an attacker can harvest credentials, configuration strings, or environmental secrets that may lead to privilege escalation or lateral movement within the integrated development and operations environment. Since the exploitation occurs through legitimate UI or API channels, it may leave minimal footprint in standard logs, complicating detection efforts if the user is already authorized to view such requests."
}