Description
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to a Server-Side Request Forgery (SSRF) vulnerability.
Published: 2026-11-08
Score: 7.7 High
EPSS: n/a
KEV: No
Impact: Remote information disclosure via SSRF
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a Server‑Side Request Forgery that allows an authenticated attacker to instruct DataStage to make arbitrary outbound HTTP requests. This can expose sensitive internal resources or data that the DataStage service has permission to access, thereby compromising confidentiality and potentially revealing network topology or credentials. The weakness is classified as CWE‑918.

Affected Systems

IBM DataStage on Cloud Pak for Data, version 5.4.0.0. The issue is resolved in the 5.4 patch 8 release or any newer patch thereafter.

Risk and Exploitability

The CVSS score of 7.7 indicates high severity. No EPSS score is published, and the vulnerability is not listed in CISA's KEV catalog, suggesting that it is not currently exploited in the wild. However, the requirement for authentication does not diminish the risk—once an attacker can log in, the SSRF can be leveraged to access protected resources. The impact could be significant if the application grants broad network visibility to authenticated users.

Generated by OpenCVE AI on November 8, 2026 at 18:31 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading DataStage on Cloud Pak for Data. Product(s)Version(s) number and/or range Remediation/Fix/InstructionsDataStage on Cloud Pak for Data5.4.0.0 Upgrade to 5.4 patch 8 or later by following these instructions https://www.ibm.com/docs/en/software-hub/5.4.x .

OpenCVE Recommended Actions

  • Upgrade IBM DataStage on Cloud Pak for Data to patch 8 (5.4.8) or a newer version following IBM’s instructions.
  • Restrict the creation of DataStage jobs to privileged accounts only, reducing the number of users who can trigger outbound requests.
  • Configure network firewalls or proxy rules to limit outbound traffic from DataStage to only required destinations.
  • Enable logging of DataStage outbound requests and review logs for suspicious activity regularly.

Generated by OpenCVE AI on November 8, 2026 at 18:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 08 Nov 2026 17:00:00 +0000

Type Values Removed Values Added
Description IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to a Server-Side Request Forgery (SSRF) vulnerability.
Title DataStage on Cloud Pak for Data has several vulnerabilities
First Time appeared Ibm
Ibm datastage On Cloud Pak For Data
Weaknesses CWE-918
CPEs cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm datastage On Cloud Pak For Data
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

Ibm Datastage On Cloud Pak For Data
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-11-08T16:52:10.012Z

Reserved: 2026-10-07T18:13:08.508Z

Link: CVE-2026-107330

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-08T17:16:35.407

Modified: 2026-11-08T17:16:35.517

Link: CVE-2026-107330

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-08T19:00:13Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)