CVE-2025-36145 Multiple Vulnerabilities in watsonx.data

What is CVE-2025-36145?

CVE-2025-36145 is a medium-severity vulnerability in IBM watsonx.data, published on 26 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

IBM watsonx.data 2.2 through 2.3.1 IBM Lakehouse does not properly restrict inbound and outbound connections which could allow an attacker to transfer or modify files without restrictions.

Weakness: CWE-923

Which versions are affected by CVE-2025-36145?

It affects 1 product.

Products include Ibm Watsonx.data.

How do I fix CVE-2025-36145?

No fix has been published for CVE-2025-36145 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-36145 being exploited?

There is no known exploitation of CVE-2025-36145 in the wild and no public exploit code.

Other vulnerabilities in IBM watsonx.data

• CVE-2025-36140 IBM watsonx.data Denial of Service Medium 6.5
• CVE-2025-36335 Vulnerabilities found Medium 6.2
• CVE-2025-36139 IBM watsonx.data cross-site scripting Medium 5.5
• CVE-2025-36180 Inadequate Pod Communication Restrictions, affects watsonx.data Medium 5.3
• CVE-2025-36143 IBM watsonx.data command execution Medium 4.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m5w6-r57x-w289.