CVE-2026-107330: DataStage on Cloud Pak for Data has several vulnerabilities

Published Nov 8, 2026

Updated

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to a Server-Side Request Forgery (SSRF) vulnerability.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade DataStage on Cloud Pak for Data to a version that resolves this vulnerability.
Fixed in 5.4Patch patch 8

Event History

Nov 8, 2026

CVE Published

via MITRE·04:52 PM

Data Sourced

via MITRE·04:52 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A remote attacker must be authenticated to exploit the SSRF vulnerability. The provided information does not indicate that unauthenticated users are affected.

What is the potential impact?

An authenticated attacker could use the vulnerability to obtain sensitive information. The supplied vector indicates network-based exploitation with low attack complexity and no user interaction required.

Which deployment is identified as affected?

IBM DataStage on Cloud Pak for Data version 5.4.0.0 is identified as affected in the provided information.