High priorityDisclosed

Advisory · CVE-2026-80412

DataStage OSH script generation allows remote code execution

Improper escaping of connector property values during OSH script generation in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote authenticated attacker execute arbitrary code.

Advisory published September 23, 2026Independent summary
Vendor
IBM
Product
IBM DataStage on Cloud Pak for Data
Identifier / CWE
CVE-2026-80412
CWE-78
Action timing
Immediate
ELI5

Explain it like I’m five

DataStage writes out little scripts to run data jobs, filling in blanks with settings people typed. It does not clean up the settings first, so a user can write extra computer instructions into a setting and they end up running as part of the script.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Connector settings

    A remote authenticated attacker sets connector property values containing crafted content.

  2. 02OSH generation

    DataStage generates OSH scripts from those properties without properly escaping the values.

  3. 03Script execution

    The generated script runs as part of normal job execution.

  4. 04Code execution

    The attacker's injected content executes as arbitrary code with the service's privileges.

What happened

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper escaping of connector property values during OSH script generation. Connector settings, which are ordinary configuration data, become executable script content. IBM rates the issue high at CVSS 8.8 in its security bulletin, which covers this flaw alongside CVE-2026-80379 and CVE-2026-80425.

What to do

  1. Follow the IBM security bulletin for remediation and apply it to all DataStage deployments.
  2. Audit connector property values in existing jobs for unexpected shell metacharacters or commands.
  3. Review which users can define or edit connectors and trim excessive grants.
  4. Review job execution logs for signs of injected commands running inside data jobs.

Management note

The attack surface here is configuration data, which teams rarely treat as hostile. Any connector property a user can edit is a potential code path into the data plane, so the audit of existing job definitions matters as much as the patch.