{"id":"CVE-2026-16325","kind":"vulnerability","aliases":["CVE-2026-16325"],"related":[],"title":"IBM DataStage on Cloud Pak for Data: header input lets an attacker run scripts","description":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary scripts due to improper neutralization of input in the X-Forwarded-Host header.","summary":"IBM DataStage on Cloud Pak for Data 5.4.0.0 does not properly neutralize input in the X-Forwarded-Host header. A remote attacker with a valid login can use this to execute arbitrary scripts.","severity":"medium","cvss":4.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloud-pak-for-data","datastage","ibm","vendor"],"not_affected_if":["other-versions"],"how_to_check":"- Check whether the deployment runs IBM DataStage on Cloud Pak for Data version `5.4.0.0`","fix":null,"status":"open","published_at":"2026-11-08T18:17:02+00:00","first_seen_at":"2026-11-08T18:22:22+00:00","triaged_at":"2026-11-08T18:23:01+00:00","updated_at":"2026-11-08T18:23:01+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-08T18:23:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM DataStage on Cloud Pak for Data: header input lets an attacker run scripts","impact":"high","summary":"IBM DataStage on Cloud Pak for Data 5.4.0.0 does not properly neutralize input in the X-Forwarded-Host header. A remote attacker with a valid login can use this to execute arbitrary scripts.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm","datastage","cloud-pak-for-data"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs arbitrary scripts on the DataStage server","analyst_note":"Confirm the fixed version and IBM advisory for DataStage 5.4.0.0 on Cloud Pak for Data; the NVD entry gives no fix.","how_to_check":"- Check whether the deployment runs IBM DataStage on Cloud Pak for Data version `5.4.0.0`\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-versions"],"who_is_affected":"Organizations running IBM DataStage on Cloud Pak for Data version 5.4.0.0 are affected. The attacker must be authenticated and reach the service over the network. The sources do not say what configuration is needed beyond that.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00071,"input_tokens":4543,"output_tokens":512,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-16325':17A,20A '-2026':16A,19A '5.4.0.0':36B,70C 'allow':72C 'arbitrari':61B,79C 'attack':12A,51B,76C 'authent':75C 'cloud':4A,22B,32B,66C 'cloud-pak-for-data':21B 'could':71C 'cve':15A,18A 'data':7A,25B,35B,69C 'datastag':2A,26B,30B,64C 'due':81C 'execut':60B,78C 'forward':46B,91C 'header':8A,48B,93C 'host':47B,92C 'ibm':1A,27B,29B,63C 'improp':83C 'input':9A,41B,86C 'let':10A 'login':55B 'neutral':40B,84C 'pak':5A,23B,33B,67C 'proper':39B 'remot':50B,74C 'run':13A 'script':14A,62B,80C 'use':57B 'valid':54B 'vendor':28B 'x':45B,90C 'x-forwarded-host':44B,89C","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM DataStage on Cloud Pak for Data version 5.4.0.0 are affected. The attacker must be authenticated and reach the service over the network. The sources do not say what configuration is needed beyond that.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cloudpakfordata","datastage","ibm","medium","vendor"],"campaign_type":null,"search_a":"'-16325':17A,20A '-2026':16A,19A 'attack':12A 'cloud':4A 'cve':15A,18A 'data':7A 'datastag':2A 'header':8A 'ibm':1A 'input':9A 'let':10A 'pak':5A 'run':13A 'script':14A","search_b":"'5.4.0.0':36B 'arbitrari':61B 'attack':51B 'cloud':22B,32B 'cloud-pak-for-data':21B 'data':25B,35B 'datastag':26B,30B 'execut':60B 'forward':46B 'header':48B 'host':47B 'ibm':27B,29B 'input':41B 'login':55B 'neutral':40B 'pak':23B,33B 'proper':39B 'remot':50B 'script':62B 'use':57B 'valid':54B 'vendor':28B 'x':45B 'x-forwarded-host':44B","search_c":"'5.4.0.0':70C 'allow':72C 'arbitrari':79C 'attack':76C 'authent':75C 'cloud':66C 'could':71C 'data':69C 'datastag':64C 'due':81C 'execut':78C 'forward':91C 'header':93C 'host':92C 'ibm':63C 'improp':83C 'input':86C 'neutral':84C 'pak':67C 'remot':74C 'script':80C 'x':90C 'x-forwarded-host':89C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T18:17:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-16325","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16325","severity":null,"published_at":"2026-11-08T18:17:02+00:00","modified_at":"2026-11-08T18:17:02+00:00","first_seen_at":"2026-11-08T18:22:22+00:00","fetched_at":"2026-11-08T18:22:22+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}