CVE-2026-81549: DataStage on Cloud Pak for Data has several vulnerabilities
DataStage on Cloud Pak for Data could allow a remote authenticated attacker to obtain sensitive information due to improper validation of the X-Forwarded-Proto header.
Other sources
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of the X-Forwarded-Proto header.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DataStage on Cloud Pak for Datato a version that resolves this vulnerability.Fixed in 5.4 patch 7
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
An attacker must be remotely authenticated. The available information does not indicate that unauthenticated users can exploit it.
What is the potential impact of successful exploitation?
A successful attacker could obtain sensitive information. The provided information does not identify the specific data that could be exposed.
What component or input is involved in the issue?
The issue is related to improper validation of the X-Forwarded-Proto HTTP header in DataStage on Cloud Pak for Data.