CVE-2026-16713

IBM Documentation Offline ships an embedded HTTP server that by default binds to 0.0.0.0, making it reachable from any network interface on the host rather than localhost only. The fix is trivial—change the binding to 127.0.0.1—but the interesting question is why this persisted across four versions of a commercial product. The root cause isn't negligent review; it's a categorization failure. Documentation tools are classified as non-critical infrastructure and exempted from security design review. This exemption meant no one ever asked: 'what happens if this server is reachable from an adjacent network?' The threat model for 'documentation' assumed static files, not a network service. When an HTTP server was embedded to serve content, the threat model assignment survived intact because categorization decisions are invisible—they resist scrutiny longer than code does. This creates a predictable vulnerability pattern. The CVSS 5.3 score itself reinforces the low-priority classification, creating a feedback loop: docs score low on risk matrices, receive minimal scrutiny, produce medium-severity CVEs, which validate the low-priority assessment. Three or more vendors have produced this exact misconfiguration across different years, suggesting the 'internal tool' exception isn't just creating review gaps—it's creating a known vulnerability class that the industry treats as idiosyncratic rather than systemic. For defenders: the immediate fix is binding to 127.0.0.1. But the workflow fix matters more. Require threat modeling for any code that opens a network socket, regardless of what the containing tool is labeled. Implement periodic configuration intent reviews—ask not just 'is this binding correct' but 'do we remember why it was set this way four versions ago?' The binding address likely originated as a debugging convenience in v1.0.0, and the context evaporated within 12-18 months as the original team rotated out. Subsequent maintainers inherited it as ambient configuration: 'this has always been this way, so there must be a reason.' That survivorship bias masquerading as institutional memory is the actual vulnerability. The blast radius matters more than the CVSS suggests. A docs server running on 50,000 employee endpoints isn't isolated—it's distributed, and reaching it from an adjacent network enables lateral movement that the 'non-critical' classification never accounted for.

Reviewed through automated stages and approved by a human before publication.