Advisory · CVE-2026-82101
Authenticated path traversal can knock over IBM DataStage on Cloud Pak for Data
IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote attacker use a path traversal flaw to cause a denial of service. IBM rates it CVSS 3.1 9.6.
- Vendor
- IBM
- Product
- DataStage on Cloud Pak for Data
- Identifier / CWE
- CVE-2026-82101
CWE-22 - Action timing
- Immediate
Explain it like I’m five
A signed-in user can write file paths that wander outside the folder DataStage meant to keep them in, and use that escape to disrupt the service.
- 01Sign in
An attacker with a valid low-privilege DataStage account reaches the affected component.
- 02Crafted path
The attacker supplies a pathname that traverses outside the intended directory.
- 03Escape and impact
The traversal is not stopped, and the attacker disrupts DataStage availability and integrity.
What happened
IBM disclosed CVE-2026-82101 in its DataStage on Cloud Pak for Data bulletin. Version 5.4.0.0 is affected. The flaw is a path traversal weakness (CWE-22) that an authenticated remote attacker can use to cause a denial of service; IBM’s vector also scores high integrity impact with changed scope.
No fixed version is named in the NVD record, so remediation follows the IBM bulletin rather than a version guess here.
What to do
- Inventory every DataStage on Cloud Pak for Data deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to DataStage on Cloud Pak for Data while remediation is underway, especially for internet-facing instances.
- Review application and server logs for unexpected DataStage service restarts, traversal-style path strings in request logs, and file changes outside DataStage working directories.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
DataStage sits in the middle of enterprise data pipelines. An authenticated denial of service there is a pipeline outage, not a nuisance. Patch from the IBM bulletin and review who holds DataStage accounts.