IBM DevOps Loop Session Expiration Vulnerability Advisory

IBM DevOps Loop Contains Session Expiration Vulnerability Vulnerability Overview IBM DevOps Loop contains a session expiration vulnerability that allows attackers to continue accessing protected resources using expired authentication tokens. Affected Products Affected Products: IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 Operating System: Linux Remediation It is recommended to update immediately to IBM DevOps Loop 1.0.3 to resolve this vulnerability. References Complete CVSS v3 Guide On-line Calculator v3 Related Resources IBM Secure Engineering Web Portal IBM Product Security Incident Response Blog Acknowledgments Sunil Dandamudi (HCL Software) Change History 25 Jun 2026: Initial Publication Disclaimer According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an industry standard designed to communicate vulnerability severity and assist in determining the urgency and priority of response. IBM provides the CVSS score “as is,” with no expressed or implied warranties. Customers should evaluate the impact of the vulnerability on their environment. IBM regularly updates the records of components in its product portfolio and addresses vulnerabilities for packages identified before they were previously known. The citation of an older CVE ID does not indicate that IBM has been using the referenced product since that date, nor does it indicate that IBM was aware of the vulnerability at that time. We are working to inform customers of relevant vulnerabilities as we become more aware. The cited “Affected Products and Versions” are intended to represent IBM support and versions only, and have not reached their end-of-support or warranty dates. Therefore, the citation of unsupported or extended-support products and versions in this security advisory does not constitute a determination by IBM that they are unaffected by the vulnerability. The citation of one or more unsupported versions in this security advisory does not obligate IBM to fix any unsupported or extended-support product or version.

Goal Reached Thanks to every supporter — we hit 100%!

IBM DevOps Loop Session Expiration Vulnerability Advisory