DATASTAGE ON CLOUD PAK FOR DATA · CVE-2026-107331 · Vendor
FIX → 5.4 patch 8 ✓ verified
IBM DataStage on Cloud Pak for Data 5.4.0.0 has an absolute-path traversal flaw (CWE-36). A remote authenticated attacker can obtain sensitive information. IBM rates it CVSS 9.9 and fixes it in 5.4 patch 8; it lists no workarounds.
first public Nov 8, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running IBM DataStage on Cloud Pak for Data 5.4.0.0 that have not applied 5.4 patch 8 or later. An attacker needs a valid login and network access, and can read sensitive information via absolute-path traversal; IBM does not say which data. Teams not running this product, or already on patch 8 or later, can skip it.
Not affected if other-version, patch-8-or-later
Who cares auth-required, cloud-pak-for-data, ibm-datastage
5.4.0.0 without 5.4 patch 8 or later is affectedIBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 5.4 patch 8
Upgrade DataStage on Cloud Pak for Data to 5.4 patch 8 or later (IBM bulletin 7294270)