AI and data stack advisories

Severe, 6 weeks977Projects326

977 severe, 6 weeks · 326 projects

IBMCVE-2026-81212

IBM DataStage on Cloud Pak for Data: improper authorization

IBM

CVE-2026-81212 · Published Oct 20, 2026 · updated Oct 28, 2026

Critical10.0
No fix yet
IBM advisory

IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poison any tenant's cached flow parameters.

Affected versions

PackageAffectedFixed in
DataStage on Cloud Pak for Data
Product
<= 5.4.0.0No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-285

More IBM advisories

All IBM
Medium 6.5Oct 19IBM Storage TS4500 Library: denial of serviceCVE-2025-36061no fix yetMedium 5.5Oct 19IBM Storage TS4500 Library: insufficient session expirationCVE-2025-36069no fix yetMedium 6.3Oct 19IBM Storage TS4500 Library: insufficient session expirationCVE-2025-36252no fix yetHigh 7.4Oct 1IBM confluent-kafka: information disclosureCVE-2026-15911no fix yetHigh 8.1Sep 29IBM Guardium Data Protection: path traversalCVE-2026-84842no fix yetHigh 7.8Sep 29IBM i: insecure permissionsCVE-2026-84414no fix yet