CVE-2026-81210

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0

Description The software concatenates three caller-supplied strings into a String.format path on the shared /ds-storage RWX PVC (Persistent Volume Claim), which is a storage resource shared across pods. This leads to an Insecure Direct Object Reference (IDOR) and path traversal, allowing the return of files without project Access Control List (ACL) verification. While read access is limited to files named job.log and error.log, these logs often contain sensitive information such as connection strings, customer-data row samples, and {dsnextenc} ciphertexts. This creates a risk of tenant-to-tenant data leakage.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.