CVE-2026-81210
HighCVSS 7.7Summary
IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied strings into a String.format path on the shared /ds-storage RWX PVC and returns the file with no project ACL — pure IDOR plus traversal. Read is constrained to files named job.log/error.log, but DataStage job logs routinely carry connection strings, {dsnextenc} ciphertexts, and customer-data row samples.
Risk Assessment
An authenticated tenant can read other tenants' files from the shared volume, leading to tenant-to-tenant data leakage and exposure of credentials and customer data.
Recommendation
Update IBM DataStage on Cloud Pak for Data to a patched version, enforce ACLs on the /ds-storage volume, and restrict access to job logs.
Other vulnerabilities in IBM DataStage on Cloud Pak for Data
See all- CVE-2026-82098High
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to execute arbitrary OS commands. The cause is improper neutralization of special elements used in OS commands.
- CVE-2026-82097High
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to execute arbitrary code due to a Server-Side Request Forgery (SSRF) vulnerability. The application makes requests to attacker-controlled resources.
- CVE-2026-82095High
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in OS commands. The flaw enables command injection into the operating system.
- CVE-2026-82092High
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability. The attacker can read files outside the permitted directory.
- CVE-2026-81554High
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability. The attacker can read files outside the permitted directory.
- CVE-2026-81551High
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to arbitrarily write to or delete files on shared storage due to a path traversal vulnerability. The attacker can manipulate files outside the permitted area.
- CVE-2026-81550High
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in OS commands. The flaw enables command injection into the operating system.
- CVE-2026-81540High
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to overwrite ruleset files belonging to other tenants due to a path traversal vulnerability. The attacker can modify files outside their own area.
- CVE-2026-81207High
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows any authenticated tenant — with no project membership or role — fully controls scheme/host/port/path of an outbound fetch originating from a shared-infrastructure pod, and the WSDL body is reflected verbatim to the caller. The ds-canvas pod sits on the OpenShift overlay with reach to co-tenant services, in-cluster CP4D APIs, and link-local addresses.
- CVE-2026-80436High
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service by deleting arbitrary RabbitMQ queues or exchanges due to improper authorization.
Original NVD description (English source)
IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied strings into a String.format path on the shared /ds-storage RWX PVC and returns the file with no project ACL — pure IDOR plus traversal. Read is constrained to files named job.log/error.log, but DataStage job logs routinely carry connection strings, {dsnextenc} ciphertexts (decryptable via d2-f023), and customer-data row samples. This is the operator's tenant-to-tenant PVC-leakage threat verbatim; MEDIUM→HIGH via threat match.