DataStage on Cloud Pak for Data version 5.4.0.0 contains an improper validation of the X-Forwarded-Proto header that allows a remote authenticated attacker to retrieve sensitive information. This flaw is mapped to CWE-918 and can lead to exposure of confidential data, a significant breach of confidentiality.

The vulnerability affects IBM DataStage on Cloud Pak for Data 5.4.0.0. The official fix requires upgrading to IBM DataStage 5.4 patch 7 or later, following the remediation instructions provided by IBM.

The CVSS score of 9.6 indicates a very high risk. Although the EPSS score is not available, the high severity combined with the fact that the flaw requires authenticated access suggests that the threat is primarily to bona‑fide users who gain data exposure. The flaw can be exercised remotely by sending crafted HTTP requests that include a malicious X-Forwarded-Proto header; no additional privileges are needed beyond valid authentication. The vulnerability is not listed in the CISA KEV catalog, so no widespread exploitation has been reported yet, but the potential data loss remains significant.