A critical authorization flaw (CVSS 10.0) in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an unauthenticated attacker write arbitrary data into shared Redis under any tenant's key.
What Is It
CVE-2026-81212 is an improper authorization weakness (CWE-285) in IBM DataStage on Cloud Pak for Data. According to the NVD record, an unauthenticated user can perform an arbitrary write into the platform's shared Redis instance under any tenant's key. IBM's PSIRT says this "collapses the platform's credential-encryption boundary." It also lets an anonymous caller poison any tenant's cached flow parameters.
IBM PSIRT ([email protected]) submitted the record, and it was published to NVD on 2026-10-20. Its NVD status is currently "Received," which means NVD has not yet completed its own analysis.
Why It Matters
IBM rates the flaw 10.0 CRITICAL with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N:
- Network-reachable with low attack complexity
- No privileges and no user interaction required
- Changed scope: impact extends beyond the vulnerable component to other tenants' data
- High confidentiality and integrity impact; no availability impact
Any anonymous caller who can reach the service can tamper with data belonging to every tenant. Because the credential-encryption boundary breaks down, tenant isolation can no longer be relied on in affected deployments. Poisoned flow parameters could change how other tenants' DataStage flows run.
The CISA Known Exploited Vulnerabilities (KEV) catalog has no entry for CVE-2026-81212. The supplied data does not confirm active exploitation.
What's Vulnerable
| Vendor | Product | Version | Status |
|---|---|---|---|
| IBM | DataStage on Cloud Pak for Data | 5.4.0.0 | Affected |
CPE: cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*
The record lists no other versions as affected.
Patch Status
The NVD record links to an IBM support advisory (node 7289603) but gives no fixed version, patch identifier or workaround. The record has no CISA KEV entry, so there is no KEV required action or due date.
Organizations running DataStage on Cloud Pak for Data 5.4.0.0 should check IBM's advisory for remediation guidance and apply it as a priority. That priority reflects the unauthenticated, network-reachable, cross-tenant nature of the flaw.
Sources
- NVD, CVE-2026-81212
- IBM Security Bulletin (node 7289603)
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)