{"id":"CVE-2026-107330","kind":"vulnerability","aliases":["CVE-2026-107330"],"related":[],"title":"IBM DataStage on Cloud Pak: SSRF lets a logged-in user read sensitive data","description":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to a Server-Side Request Forgery (SSRF) vulnerability.","summary":"IBM DataStage 5.4.0.0 on Cloud Pak for Data has a Server-Side Request Forgery flaw. A remote attacker with a valid account can make the server send requests to internal targets and obtain sensitive information.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"DataStage on Cloud Pak for Data","fixed":["5.4 patch 8"],"affected":"5.4.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-required","cloud-pak-for-data","ibm-datastage","self-hosted","vendor"],"not_affected_if":["auth-required","other-versions","patched-5.4-patch-8"],"how_to_check":"Check the installed DataStage on Cloud Pak for Data version/patch level in the Cloud Pak for Data (Software Hub) console or via your cpd-cli/operator inventory. Version 5.4.0.0 without 5.4 patch 8 or later is affected. Also check if you run DataStage 5.3.1.x: IBM's bulletin lists only 5.4.0.0 as affected.","fix":"Upgrade DataStage on Cloud Pak for Data 5.4.0.0 to 5.4 patch 8 or later, following IBM's upgrade instructions in the bulletin.","status":"open","published_at":"2026-11-08T17:16:35+00:00","first_seen_at":"2026-11-08T17:21:59+00:00","triaged_at":"2026-11-08T17:22:05+00:00","updated_at":"2026-11-08T17:23:33+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-08T17:22:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM DataStage on Cloud Pak: SSRF lets a logged-in user read sensitive data","impact":"medium","summary":"IBM DataStage 5.4.0.0 on Cloud Pak for Data has a Server-Side Request Forgery flaw. A remote attacker with a valid account can make the server send requests to internal targets and obtain sensitive information.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-datastage","cloud-pak-for-data"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads sensitive information from internal servers via forged requests","analyst_note":"Check IBM's security bulletin for CVE-2026-107330 for the fixed version and any required configuration; the NVD entry alone does not state them.","how_to_check":"- Confirm whether the deployment runs IBM DataStage on Cloud Pak for Data at version `5.4.0.0`, for example in the Cloud Pak for Data console.\n- unknown for other checks: the sources do not say.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-versions"],"who_is_affected":"Teams running IBM DataStage 5.4.0.0 on Cloud Pak for Data where users have accounts on the platform. The sources do not name a configuration that changes exposure, so the unknown parts should be checked against IBM's advisory.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000728,"input_tokens":4539,"output_tokens":549,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check IBM's security bulletin for CVE-2026-107330 for the fixed version and any required configuration; the NVD entry alone does not state them.","search":"'-107330':18A,21A '-2026':17A,20A '5.4.0.0':45B,86C 'account':65B 'allow':88C 'attack':61B,92C 'auth':29B 'auth-requir':28B 'authent':91C 'cloud':4A,24A,32B,47B,82C 'cloud-pak-for-data':31B 'could':87C 'cve':16A,19A 'data':15A,27A,35B,50B,85C 'datastag':2A,38B,44B,80C 'datastage':22A 'due':97C 'flaw':58B 'for':26A 'forgeri':57B,104C 'host':41B 'ibm':1A,37B,43B,79C 'ibm-datastag':36B 'inform':78B,96C 'intern':73B 'let':7A 'log':10A 'logged-in':9A 'make':67B 'obtain':76B,94C 'on':23A 'pak':5A,25A,33B,48B,83C 'read':13A 'remot':60B,90C 'request':56B,71B,103C 'requir':30B 'self':40B 'self-host':39B 'send':70B 'sensit':14A,77B,95C 'server':54B,69B,101C 'server-sid':53B,100C 'side':55B,102C 'ssrf':6A,105C 'target':74B 'user':12A 'valid':64B 'vendor':42B 'vulner':106C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed IBM DataStage on Cloud Pak for Data 5.4.0.0 that have not applied 5.4 patch 8. An attacker needs a valid authenticated account (low privileges) and network access; they can make the server send requests to internal targets and read sensitive data (IBM CVSS 7.7, scope changed, high confidentiality impact). Deployments on other versions, or already on 5.4 patch 8 or later, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-08T17:23:33Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7294270","run_id":2200},"products":{"at":"2026-11-08T17:23:33Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7294270","run_id":2200},"mitigations":{"at":"2026-11-08T17:23:33Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7294270","run_id":2200},"workarounds":{"at":"2026-11-08T17:23:33Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7294270","run_id":2200},"how_to_check":{"at":"2026-11-08T17:23:33Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7294270","run_id":2200},"who_affected":{"at":"2026-11-08T17:23:33Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7294270","run_id":2200}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["datastageoncloudpakfordata","oncloudpakfordata"],"ptokens":["cloud","data","datastage","for","on","pak"],"labels":["authrequired","cloudpakfordata","high","ibmdatastage","selfhosted","vendor"],"campaign_type":null,"search_a":"'-107330':18A,21A '-2026':17A,20A 'cloud':4A,24A 'cve':16A,19A 'data':15A,27A 'datastag':2A 'datastage':22A 'for':26A 'ibm':1A 'let':7A 'log':10A 'logged-in':9A 'on':23A 'pak':5A,25A 'read':13A 'sensit':14A 'ssrf':6A 'user':12A","search_b":"'5.4.0.0':45B 'account':65B 'attack':61B 'auth':29B 'auth-requir':28B 'cloud':32B,47B 'cloud-pak-for-data':31B 'data':35B,50B 'datastag':38B,44B 'flaw':58B 'forgeri':57B 'host':41B 'ibm':37B,43B 'ibm-datastag':36B 'inform':78B 'intern':73B 'make':67B 'obtain':76B 'pak':33B,48B 'remot':60B 'request':56B,71B 'requir':30B 'self':40B 'self-host':39B 'send':70B 'sensit':77B 'server':54B,69B 'server-sid':53B 'side':55B 'target':74B 'valid':64B 'vendor':42B","search_c":"'5.4.0.0':86C 'allow':88C 'attack':92C 'authent':91C 'cloud':82C 'could':87C 'data':85C 'datastag':80C 'due':97C 'forgeri':104C 'ibm':79C 'inform':96C 'obtain':94C 'pak':83C 'remot':90C 'request':103C 'sensit':95C 'server':101C 'server-sid':100C 'side':102C 'ssrf':105C 'vulner':106C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T17:16:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107330","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107330","severity":null,"published_at":"2026-11-08T17:16:35+00:00","modified_at":"2026-11-08T17:16:35+00:00","first_seen_at":"2026-11-08T17:21:59+00:00","fetched_at":"2026-11-08T17:21:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107330:2200","url":"https://www.ibm.com/support/pages/node/7294270","severity":null,"published_at":"2026-11-08T17:23:33+00:00","modified_at":"2026-11-08T17:23:33+00:00","first_seen_at":"2026-11-08T17:23:33+00:00","fetched_at":"2026-11-08T17:23:33+00:00","note":"IBM bulletin 7294270 (27 Oct 2026): CVE-2026-107330 SSRF, CVSS 7.7 (IBM), affects 5.4.0.0, fix 5.4 patch 8+, workarounds None. No exploitation or PoC found in sources read; did not search social posts (low-profile B signal). Same bulletin also covers CVE-2026-107331 (absolute path traversal, 9.9) - sibling.","cites":["https://www.ibm.com/support/pages/node/7294270"]}],"documents":[{"id":102707,"url":"https://www.ibm.com/support/pages/node/7294270","title":"IBM Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities (7294270)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}