CVE-2025-36359: IBM DevOps Automation and Loop Session Invalidation Flaw

Technical summary

The vulnerability stems from improper session invalidation (CWE-613). When a user's session expires in these IBM products, the system does not properly expire or revoke the associated session ID. An attacker with valid authentication credentials can reuse expired session tokens to assume the identity of other users. The attack requires low complexity and no user interaction once an expired session identifier is obtained. Network-accessible deployment scenarios mean remote exploitation is feasible for any authenticated user on the system.

Business impact

DevOps automation platforms are critical infrastructure components that manage deployments, configurations, and infrastructure-as-code across production environments. Session hijacking via expired tokens could allow attackers to execute unauthorized deployments, alter configurations, exfiltrate secrets stored in the platform, or disrupt CI/CD pipelines. In multi-tenant or shared automation environments, this creates cross-user compromise scenarios where one team's compromised account becomes a pivot point to other teams' resources. Recovery requires invalidating all active sessions and auditing deployment logs.

Affected systems

IBM DevOps Automation version 1.0.1 and IBM DevOps Loop version 1.0.2 are directly impacted. Organizations running these specific versions should treat this as critical to remediation priority. Verify your installed versions against IBM documentation; adjacent versions may also require investigation pending vendor guidance.

Exploitability

Exploitation requires an authenticated user position on the system—an insider, compromised account, or lateral movement entry point. Once an attacker obtains or observes an expired session ID (from logs, traffic capture, or memory), they can reuse it to impersonate other users without additional authentication. This is a post-authentication vulnerability but becomes highly dangerous in shared environments where multiple teams or service accounts operate the platform. The CVSS score of 8.1 reflects the combination of network accessibility, low attack complexity, and high impact on confidentiality and integrity.

Remediation

Upgrade IBM DevOps Automation to a patched version beyond 1.0.1 and IBM DevOps Loop to a version beyond 1.0.2. Before patching, implement compensating controls: enforce shorter session timeouts to minimize the window of reuse, implement session binding (tie sessions to client IP or device fingerprint if supported), and conduct access reviews to ensure least-privilege authentication scopes. Log all session activity for forensic analysis of potential abuse.

Patch guidance

Contact IBM support or consult the IBM security advisories for official patch versions addressing CVE-2025-36359 for both DevOps Automation and DevOps Loop. Test patches in non-production environments first, as session changes may affect automation workflows. Coordinate patching with your change management process to avoid disrupting CI/CD schedules. After patching, invalidate all active sessions to force re-authentication.

Detection guidance

Monitor for suspicious session reuse patterns: the same session ID appearing from different IP addresses, user agents, or client contexts within a short timeframe. Audit logs should flag authentication events where a session was used after the expected expiration window. Check for unusual administrative actions or deployment changes attributed to users outside their normal working hours or geographic regions. Review session tables in the application database for entries that should have been purged post-expiration.

Why prioritize this

This vulnerability scores HIGH (8.1) and directly threatens authentication integrity in a critical infrastructure tool. DevOps platforms often possess elevated permissions and access to production secrets, making session hijacking a severe compromise vector. The ease of exploitation for authenticated users, combined with the sensitive nature of DevOps automation, justifies urgent prioritization. This is not on the CISA KEV catalog but warrants immediate attention independent of that status.

Risk score, explained

CVSS 8.1 reflects: (1) Network-accessible attack vector, (2) Low attack complexity—no specialized tools needed, (3) Prerequisite authentication that is realistic in shared environments, (4) High confidentiality impact through unauthorized access to platform data and secrets, (5) High integrity impact through unauthorized automation execution, (6) No direct availability impact but operational disruption is likely. The combination of ease of exploitation and high business impact on DevOps infrastructure justifies the HIGH severity rating.

Frequently asked questions