Advisory · CVE-2026-81552
Environment variable injection in IBM DataStage leads to command execution
IBM DataStage on Cloud Pak for Data 5.4.0.0 improperly neutralizes environment variables, allowing a remote authenticated attacker to execute arbitrary commands on the host.
- Vendor
- IBM
- Product
- DataStage on Cloud Pak for Data
- Identifier / CWE
- CVE-2026-81552
CWE-78 - Action timing
- Immediate
Explain it like I’m five
Programs read environment variables like notes pinned to a bulletin board. DataStage trusts those notes without checking them, so an attacker pins up a note that is really a command, and DataStage follows it.
- 01Authenticated access
An attacker authenticates to DataStage with low-privilege credentials.
- 02Manipulated environment variables
The attacker influences environment variables that the product consumes.
- 03Improper neutralization
DataStage uses the environment variable values without neutralizing special elements.
- 04Command execution
The injected content is executed as commands on the host.
What happened
IBM disclosed an environment variable neutralization flaw in IBM DataStage on Cloud Pak for Data 5.4.0.0 on September 24, 2026. The product improperly neutralizes environment variables, which a remote authenticated attacker can manipulate to execute arbitrary commands. No user interaction is needed. The issue is rated high at CVSS 8.8.
It belongs to a cluster of high-severity flaws in the same product version that IBM addressed in a single security bulletin, including multiple OS command injection variants and an unsafe deserialization issue.
What to do
- Apply the IBM security bulletin remediation to all DataStage on Cloud Pak for Data 5.4.0.0 deployments.
- Restrict authenticated access to trusted operators and segmented networks until patched.
- Audit for unusual environment configuration or child processes spawned by the DataStage service.
- Review pipeline job definitions for tampering if the environment was reachable by untrusted users.
- Remediate the full set of DataStage CVEs from this bulletin in one pass.
Management note
Environment variable injection is easy to overlook because it does not look like a normal input field. If DataStage accepted any operator-controlled values into its execution environment, every one of them was a potential command channel. Patch the bulletin as a whole and assume the surrounding trust boundary needs re-examination.