IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an improper authorization flaw that allows any unauthenticated user to perform an arbitrary write into the shared Redis store used by the platform. This write capability collapses the intended credential‑encryption boundary, enabling an attacker to poison any tenant’s cached flow parameters. The ability to modify cached parameters can undermine data integrity, facilitate credential leakage, and potentially allow further exploitation within the affected tenant’s environment.

The vulnerability affects IBM DataStage on Cloud Pak for Data version 5.4.0.0. IBM recommends upgrading to 5.4 patch 8 or later, following the instructions available on the IBM software‑hub documentation site.

The flaw carries a CVSS score of 10, underscoring its severe impact when exploited. The EPSS score of less than 1% suggests exploitation is not widespread yet, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw permits an unauthenticated user to write to the shared Redis store, the likely attack vector is the public or publicly reachable interface of DataStage. An attacker does not need advanced credentials but does require network access to the target system. Once written, poisoned parameters can be used to compromise credential confidentiality and integrity across tenants. Given the high severity and the low current exploitation probability, prompt mitigation is essential to prevent future exploitation.