CVE-2026-81210: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied strings into a String.format path on the shared /ds-storage RWX PVC and returns the file with no project ACL — pure IDOR plus traversal. Read is constrained to files named job.log/error.log, but DataStage job logs routinely carry connection strings, {dsnextenc} ciphertexts (decryptable via d2-f023), and customer-data row samples. This is the operator's tenant-to-tenant PVC-leakage threat verbatim; MEDIUM→HIGH via threat match.
Other sources
taillog concatenates three caller-supplied strings into a String.format path on the shared /ds-storage RWX PVC and returns the file with no project ACL — pure IDOR plus traversal. Read is constrained to files named job.log/error.log, but DataStage job logs routinely carry connection strings, {dsnextenc} ciphertexts (decryptable via d2-f023), and customer-data row samples. This is the operator's tenant-to-tenant PVC-leakage threat verbatim; MEDIUM→HIGH via threat match.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM DataStage on Cloud Pak for Datato a version that resolves this vulnerability.Fixed in 5.4.0.0Patch 5.4 patch 5 - Compensating control
Because DataStage job logs may include sensitive data (e.g., connection strings, {dsnextenc} ciphertexts decryptable via d2-f023, and customer-data row samples), treat access to the shared /ds-storage RWX PVC and DataStage log retrieval endpoints as a tenant-isolation boundary until the DataStage upgrade (5.4 patch 5 or later) is completed.
Event History
Frequently Asked Questions
What access would an attacker need to exploit this?
The attacker needs to be able to invoke tail_log and control the three strings used to construct the file path. The issue does not describe any required project-level authorization check.
Does limiting reads to job.log and error.log prevent meaningful data exposure?
No. DataStage job logs can contain connection strings, {dsnextenc} ciphertexts that are decryptable via d2-f023, and customer-data row samples.
Can this expose data belonging to another tenant or project?
Yes. The affected path is on the shared /ds-storage RWX PVC, and returned files are not subject to a project ACL. Path traversal combined with the missing authorization check enables tenant-to-tenant log access.