CVE-2026-81208: IBM DataStage on Cloud Pak for Data vulnerability
The pull endpoint decrypts any {dsnextenc}/{encval} blob with the cluster-wide DSNEXTSECKEY and re-encrypts under a caller-supplied AES key/IV — a universal, batchable decryption oracle functionally equivalent to stealing the master key. Because DSNEXTSECKEY is shared per-region and never rotated, this is cross-tenant: any authenticated user recovers any other tenant's connection passwords, Git PATs, and IAM API keys. Two preconditions, but the second (obtain ciphertext) is satisfied by the product's own intentional ciphertext exposure; HIGH is correct and arguably understated.
Affected Software
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
Any authenticated user in a region is in scope. The impact crosses tenant boundaries because the encryption key is shared per region.
What does an attacker need to perform the attack?
The attacker needs authenticated access and a ciphertext blob. The required ciphertext is intentionally exposed by the product, so obtaining it is described as an available precondition.
What information could be recovered from another tenant?
An attacker can recover other tenants' connection passwords, Git personal access tokens, and IAM API keys from the exposed encrypted blobs.