CVE-2026-81208: DataStage on Cloud Pak for Data has several vulnerabilities
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow an authenticated user to access sensitive information due to improper handling of encrypted credentials. An attacker could exploit this vulnerability to obtain credentials intended for other users or environments.
Other sources
The pull endpoint decrypts any {dsnextenc}/{encval} blob with the cluster-wide DSNEXTSECKEY and re-encrypts under a caller-supplied AES key/IV — a universal, batchable decryption oracle functionally equivalent to stealing the master key. Because DSNEXTSECKEY is shared per-region and never rotated, this is cross-tenant: any authenticated user recovers any other tenant's connection passwords, Git PATs, and IAM API keys. Two preconditions, but the second (obtain ciphertext) is satisfied by the product's own intentional ciphertext exposure; HIGH is correct and arguably understated.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM DataStage on Cloud Pak for Datato a version that resolves this vulnerability.Fixed in 5.4 patch 7
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
Any authenticated user in a region is in scope. The impact crosses tenant boundaries because the encryption key is shared per region.
What does an attacker need to perform the attack?
The attacker needs authenticated access and a ciphertext blob. The required ciphertext is intentionally exposed by the product, so obtaining it is described as an available precondition.
What information could be recovered from another tenant?
An attacker can recover other tenants' connection passwords, Git personal access tokens, and IAM API keys from the exposed encrypted blobs.