IBM DataStage on Cloud Pak for Data 5.4.0.0

Published September 10, 2026 CVE-2026-82092

IBM's DataStage tool inside Cloud Pak for Data has a bug that lets a logged-in user read files they should not have access. The attacker only needs a regular account, not administrator rights.

Severity
HighCVSS 3.1 · 8.8
Fix
Fixed in 5.4 patch 5
Affected versions
5.4.0
Weakness
CWE-36Absolute Path Traversal
Exploit likelihood
0.54% in 30 daysEPSS, higher than 44% of known flaws
Affects
DataStage on Cloud Pak for Data
Exploited
Not confirmedNo confirmation recorded
CISA SSVC
No known exploitationAutomatable: no · Technical impact: total
EU ID
EUVD-2026-75770ENISA vulnerability database

How it works

  • An attacker needs a valid account on the platform, even a low-privilege one, before this works.
  • That account can submit a full, absolute file path instead of the relative path the system expects for a request.
  • DataStage on Cloud Pak for Data version 5.4.0.0 does not properly restrict that path to its intended storage area.
  • This lets the account pull back files stored elsewhere on the server, outside the area it is supposed to be limited, exposing sensitive information.
  • IBM's bulletin does not name the exact screen, form field, or API call involved.

What to do

Check whether your organization runs DataStage on Cloud Pak for Data version 5.4.0.0. Compare the installed patch level against the fix information in IBM's security bulletin for CVE-2026-82092.

Upgrade DataStage on Cloud Pak for Data to 5.4 patch 5 or later, following the official IBM upgrade instructions. Confirm the upgrade succeeded by checking your installed patch level against the version listed in that documentation.

Technical details

Affected software: DataStage on Cloud Pak for Databy IBM

CVE-2026-82092 is an absolute-path traversal flaw (CWE-36) in IBM DataStage on Cloud Pak for Data 5.4.0.0. It carries a CVSS 3.1 score of 8.8: network-reachable, low attack complexity, no user interaction needed, but the attacker must already have low-level authenticated access. Successful exploitation gives high confidentiality, integrity, and availability impact according to IBM's own scoring, though the published description only confirms information disclosure. IBM's bulletin bundles this with numerous unrelated open-source-package flaws in the same product; the fix for this specific issue is patch 5 or later for the 5.4 branch.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source