IBM DataStage: Six Vulnerabilities Including RCE and MitM Disclosed Together
Key findings • Six vulnerabilities disclosed for IBM DataStage on Cloud Pak for Data 5.4.0.0 on October 12, 2026. • Three critical vulnerabilities (CVSSv3 9.6) allow for remote code execution…
Key findings
- Six vulnerabilities disclosed for IBM DataStage on Cloud Pak for Data 5.4.0.0 on October 12, 2026.
- Three critical vulnerabilities (CVSSv3 9.6) allow for remote code execution via path traversal and OS command injection.
- Additional critical flaws include sensitive information exposure and denial of service.
- A high severity vulnerability enables man-in-the-middle attacks with forged TLS certificates.
- All vulnerabilities affect version 5.4.0.0; users must update to patched versions.
On October 12, 2026, a batch of six vulnerabilities was disclosed for IBM DataStage on Cloud Pak for Data, with a critical severity rating of CVSSv3 9.6. These vulnerabilities pose significant risks, including remote code execution and denial of service.
Remote Code Execution Vulnerabilities
Three critical vulnerabilities (CVE-2026-82110, CVE-2026-82108, and CVE-2026-82096) allow remote authenticated attackers to execute arbitrary code. CVE-2026-82110 stems from improper validation of pathname during a path traversal, while CVE-2026-82108 and CVE-2026-82096 are due to improper neutralization of special elements used in OS commands. These flaws could enable attackers to take full control of affected systems.
Information Exposure and Denial of Service
CVE-2026-82103, a critical vulnerability, allows remote authenticated attackers to obtain sensitive information due to an exposure of sensitive information to an unauthorized actor. Additionally, CVE-2026-82101, also critical, permits a remote authenticated attacker to cause a denial of service through a path traversal vulnerability.
Man-in-the-Middle Attack
CVE-2026-84418, a high severity vulnerability, could allow a man-in-the-middle attacker to present a forged TLS certificate. This would enable them to intercept the connection and capture the IAM bearer Authorization header, granting them full platform-scope tenant API access.
Affected Versions and Patching
All disclosed vulnerabilities affect IBM DataStage on Cloud Pak for Data version 5.4.0.0. Users are strongly advised to update to a patched version as soon as possible to mitigate these risks. Specific patch version details should be obtained from IBM's official security advisories.
These vulnerabilities highlight the critical need for continuous security monitoring and timely patching of enterprise data integration platforms like IBM DataStage. The potential for remote code execution and sensitive data exposure necessitates immediate attention from all users of the affected product.