CVE-2026-84418: DataStage on Cloud Pak for Data Improper Certificate Validation
IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header automatically attached by the session adapter. The captured token grants full platform-scope tenant API access, enabling the attacker to read and manipulate the victim's DataStage projects, flows, assets, and pipeline definitions. This is client-side SDK code running on the user's own machine, so exploitation requires an external network interceptor rather than a co-tenant in the shared cluster.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DataStage on Cloud Pak for Datato a version that resolves this vulnerability.Fixed in 5.4 patch 7
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Users running the affected client-side DataStage SDK code on their own machines are exposed when their connection can be intercepted by an external network attacker. A co-tenant in the shared Cloud Pak for Data cluster is not sufficient for exploitation.
What does an attacker need to exploit it?
The attacker must be able to perform a man-in-the-middle interception of the victim's network connection and present a forged TLS certificate. No authentication or user interaction is required according to the supplied vector.
What could an attacker obtain or do after successful interception?
The attacker can capture the IAM bearer Authorization header automatically attached by the session adapter. That token grants full platform-scope tenant API access, allowing access to and manipulation of DataStage projects, flows, assets, and pipeline definitions.