Technical impact
The vulnerability arises from improper certificate validation in client‑side SDK code of IBM DataStage on Cloud Pak for Data 5.4.0.0, allowing an attacker to present a forged TLS certificate. This leads to a man‑in‑the‑middle scenario where the attacker can intercept the connection and automatically capture the IAM bearer Authorization header. The stolen token grants full platform‑scope tenant API access, enabling the attacker to read, modify, or delete DataStage projects, flows, assets, and pipeline definitions. The weakness is classified as CWE‑295, an improper certificate validation flaw.
Affected Systems
IBM DataStage on Cloud Pak for Data version 5.4.0.0 is affected. The vulnerability is limited to this specific version and the corresponding client SDK components used on the user’s machine.
Risk and Exploitability
With a CVSS score of 7.4, the vulnerability is considered high severity. The EPSS score is not available, making it difficult to assess current exploitation likelihood, but the lack of a KEV listing suggests no widespread known exploitation. The threat requires an external network interceptor in front of the client’s connection; thus, the vulnerability is exploitable when an attacker can position themselves between the user and IBM’s platform services. Successful exploitation results in complete compromise of the victim’s tenant API and access to all DataStage data and operations.
