ibm bob vulnerabilities

Latest ibm bob CVEs

Newest publication first

1. CVE-2026-5514 IBM Bob is vulnerable to unauthorized session token exposure due to improper handling of authentication provider session information

   Published 2026-11-13

   Low·CVSS 3.3 EPSS 0.18%

   IBM Bob 2.0.3 allows unauthorized extensions to retrieve session tokens via the authentication provider API. The token is exposed in the account identifier field during account enumeration, without requiring explicit user consent. This may allow malicious extensions to access sen...

2. CVE-2026-9764 IBM Bob is vulnerable to Remote Code Execution due to improper control of workspace-defined MCP server execution

   Published 2026-11-08

   High·CVSS 8.8 EPSS 0.29%

   IBM Bob 1.0.4 through 2.0.1 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.