Live › vulnerability › CVE-2026-81212
Go to dashboardIBM DataStage on Cloud Pak for Data 5.4.0.0 lets an unauthenticated network caller write arbitrary data into the shared Redis under any tenant's key. That can poison cached flow parameters and break the credential-encryption boundary across tenants. CVSS 10.0 (IBM), CWE-285. IBM's fix is 5.4 patch 8 or later, and it lists no workaround.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| DataStage on Cloud Pak for Data | vendor | 5.4.0.0 | 5.4 patch 8 |
5.4.0.0 without 5.4 patch 8 applied (check the installed DataStage service version and patch level in the Software Hub/cpd-cli service listing)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poison any tenant's cached flow parameters.
This page as .md · .json · in your agent: get_signal("CVE-2026-81212")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.