CVE-2026-81210

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Published Sep 10, 2026 CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Description

IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied strings into a String.format path on the shared /ds-storage RWX PVC and returns the file with no project ACL — pure IDOR plus traversal. Read is constrained to files named job.log/error.log, but DataStage job logs routinely carry connection strings, {dsnextenc} ciphertexts (decryptable via d2-f023), and customer-data row samples. This is the operator's tenant-to-tenant PVC-leakage threat verbatim; MEDIUM→HIGH via threat match.

Analysis

Technical impact

A flaw exists when DataStage concatenates three caller‑supplied strings into a String.format path that points to the shared /ds‑storage RWX PVC and then returns the requested file without applying any project ACLs. The vulnerability allows pure IDOR combined with directory traversal. Although only job.log and error.log files are exposed, those logs routinely contain connection strings, encrypted ciphertexts, and customer data samples, enabling an attacker to read sensitive information from other tenants.

Affected Systems

IBM DataStage on Cloud Pak for Data version 5.4.0.0 is affected. No other versions are currently listed as vulnerable.

Risk and Exploitability

The CVSS score of 7.7 indicates a medium‑to‑high severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the issue by crafting a request that bypasses ACL checks and traverses to locate log files on the shared PVC, without needing privileged credentials. Because the logs often contain sensitive information, the potential impact is high, making exploitation likely in exposed environments.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

IBM

DataStage on Cloud Pak for Data

affected

Version	Status	Constraints
`5.4.0.0`	affected	—

Configuration 1 [-]

cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Ibm

Datastage On Cloud Pak For Data

Version	Status	Scheme	Platform
`5.4.0.0`	affected	generic	—

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading DataStage on Cloud Pak for Data. Product(s)Version(s) number and/or range Remediation/Fix/InstructionsDataStage on Cloud Pak for Data5.4.0.0 Upgrade to 5.4 patch 5 or later by following these instructions https://www.ibm.com/docs/en/software-hub/5.4.x .

OpenCVE Recommended Actions

Upgrade DataStage on Cloud Pak for Data to patch 5 or later of the 5.4 release line
Follow IBM’s upgrade instructions at https://www.ibm.com/docs/en/software-hub/5.4.x
Implement or enforce project access controls on the /ds‑storage PVC to limit read access to log files

Generated by OpenCVE AI on September 11, 2026 at 04:47 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.340% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.ibm.com/support/pages/node/7286562

History

Sep 16, 2026 1:00 AM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:::::::*

Sep 15, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 10, 2026 9:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied strings into a String.format path on the shared /ds-storage RWX PVC and returns the file with no project ACL — pure IDOR plus traversal. Read is constrained to files named job.log/error.log, but DataStage job logs routinely carry connection strings, {dsnextenc} ciphertexts (decryptable via d2-f023), and customer-data row samples. This is the operator's tenant-to-tenant PVC-leakage threat verbatim; MEDIUM→HIGH via threat match.
Title		DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
First Time appeared		Ibm Ibm datastage On Cloud Pak For Data
Weaknesses		CWE-639
CPEs		cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:::::::*
Vendors & Products		Ibm Ibm datastage On Cloud Pak For Data
References		https://www.ibm.com/support/pages/node/7286562
Metrics		cvssV3_1 `{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}`