CVE-2026-81207: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
Any authenticated tenant — with no project membership or role — fully controls scheme/host/port/path of an outbound fetch originating from a shared-infrastructure pod, and the WSDL body is reflected verbatim to the caller. The ds-canvas pod sits on the OpenShift overlay with reach to co-tenant services, in-cluster CP4D APIs, and link-local addresses. Scope is Changed, confidentiality High (response-reflecting), integrity Low (GET-only side-effects).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM DataStage on Cloud Pak for Datato a version that resolves this vulnerability.Fixed in 5.4 patch 5 or later
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
Any authenticated tenant can exploit it, even without project membership or an assigned role. The issue is therefore exposed to low-privilege authenticated users rather than only DataStage project administrators.
What systems can the vulnerable outbound request reach?
The request originates from the shared ds-canvas pod on the OpenShift overlay. It can reach co-tenant services, in-cluster Cloud Pak for Data APIs, and link-local addresses.
What can an attacker obtain or change through exploitation?
An attacker fully controls the scheme, host, port, and path for the outbound fetch, and the WSDL response body is reflected verbatim to them. This creates high confidentiality impact for reachable responses; integrity impact is limited to low-impact GET-only side effects.