Advisory · CVE-2026-80379
OS command injection in IBM DataStage on Cloud Pak for Data
IBM DataStage on Cloud Pak for Data 5.4.0.0 fails to neutralize special elements in OS commands, letting a remote authenticated attacker execute arbitrary commands.
- Vendor
- IBM
- Product
- IBM DataStage on Cloud Pak for Data
- Identifier / CWE
- CVE-2026-80379
CWE-78 - Action timing
- Immediate
Explain it like I’m five
DataStage builds computer instructions out of pieces, including pieces typed by users, without washing them first. A logged-in user can slip in extra instructions that the computer runs as if they were part of the job.
- 01Authenticated access
A remote attacker authenticates to DataStage on Cloud Pak for Data 5.4.0.0.
- 02Crafted input
The attacker submits input containing OS command metacharacters that are not neutralized.
- 03Command assembly
The input is incorporated into an OS command executed by the application.
- 04Execution
Arbitrary commands run with the privileges of the DataStage service.
What happened
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. IBM rates the issue high at CVSS 8.8 in its security bulletin, which covers this flaw alongside CVE-2026-80412 and CVE-2026-80425.
What to do
- Follow the IBM security bulletin for remediation and apply it to all DataStage deployments.
- Review which users hold DataStage access and remove stale or excessive grants.
- Restrict network access to DataStage services until remediated.
- Review job and system logs for unexpected command execution or unusual job definitions.
Management note
DataStage jobs routinely touch production data stores, so command execution inside the DataStage service is a short step from data access. This is one of three same-day injection flaws in the same product; patch all three together rather than treating any single one as the whole story.