{"id":"CVE-2026-81212","title":"DataStage on Cloud Pak for Data Improper Authorization","summary":"IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller …","severity":"critical","cvss":10,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","cvssSource":"cna","cwe":["CWE-285"],"vendor":"IBM","product":"DataStage on Cloud Pak for Data","affected":["datastage_on_cloud_pak_for_data 5.4.0.0"],"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T21:58:51.662Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-81212","references":[{"url":"https://www.ibm.com/support/pages/node/7289603"}],"tags":["cve.org"],"ingestedAt":"2026-10-20T22:23:33.690Z","slug":"CVE-2026-81212","body":"## Overview\n\nIBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poison any tenant's cached flow parameters.\n\n## Affected\n\n- `datastage_on_cloud_pak_for_data 5.4.0.0`\n\n## Remediation\n\nIBM strongly recommends addressing the vulnerability now by upgrading DataStage on Cloud Pak for Data.\n\nProduct(s)Version(s) number and/or range Remediation/Fix/InstructionsDataStage on Cloud Pak for Data5.4.0.0\n\nUpgrade to 5.4 patch 8 or later by following these  instructions https://www.ibm.com/docs/en/software-hub/5.4.x .","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":55,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}