ibmCVE-2026-81549

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of the X-Forwarded-Proto header.

Critical9.6CVE-2026-81549 · Published Sep 24, 2026

Affected versions

Package	Affected	Fixed in
DataStage on Cloud Pak for Data Vendor	<= 5.4.0.0	No fix yet

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Severity from: no source yet
Weakness: CWE-918

More ibm advisories

All

Date	Advisory	Severity	Fixed in
Sep 23	IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to the exposure of namespace-wide secrets via accessible file mounts. CVE-2026-80423High8.8no fix yet	High8.8	No fix yet
Sep 23	IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow an authenticated user to access sensitive information due to improper handling of encrypted credentials. CVE-2026-81208High7.7no fix yet	High7.7	No fix yet
Sep 23	IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection. CVE-2026-81536High7.7no fix yet	High7.7	No fix yet
Sep 23	IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to OS command injection. CVE-2026-81537High8.8no fix yet	High8.8	No fix yet
Sep 23	IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper escaping of connector property values during OSH script generation. CVE-2026-80412High8.8no fix yet	High8.8	No fix yet
Sep 23	IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. CVE-2026-80425High8.8no fix yet	High8.8	No fix yet

Affected versions

More ibm advisories

Critical advisories by email