{"id":"CVE-2026-81212","kind":"vulnerability","aliases":["CVE-2026-81212"],"related":[],"title":"IBM DataStage on Cloud Pak for Data: unauthenticated write to shared Redis","description":"IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poison any tenant's cached flow parameters.","summary":"IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an unauthenticated network caller write arbitrary data into the shared Redis under any tenant's key. That can poison cached flow parameters and break the credential-encryption boundary across tenants. CVSS 10.0 (IBM), CWE-285. IBM's fix is 5.4 patch 8 or later, and it lists no workaround.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"DataStage on Cloud Pak for Data","fixed":["5.4 patch 8"],"affected":"5.4.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["cloud-pak-for-data","ibm-datastage","infrastructure","multi-tenant","redis","self-hosted"],"not_affected_if":["not-installed","version-not-5.4.0.0"],"how_to_check":"Check whether DataStage is installed on your Cloud Pak for Data / Software Hub cluster and whether its version is 5.4.0.0 without 5.4 patch 8 applied (check the installed DataStage service version and patch level in the Software Hub/cpd-cli service listing). IBM gives no exploit-specific test. Until patched, restrict network access to the DataStage and shared Redis endpoints.","fix":"Upgrade DataStage on Cloud Pak for Data to 5.4 patch 8 or later, following IBM's Software Hub 5.4.x instructions. IBM lists no workaround or mitigation. After patching, consider rotating connection credentials and reviewing cached flow parameters, since an attacker could have written to them.","status":"open","published_at":"2026-10-20T22:19:51+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-23T22:34:45+00:00","updated_at":"2026-10-23T23:05:10+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:34:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"IBM DataStage on Cloud Pak for Data: unauthenticated write to shared Redis","impact":"high","summary":"IBM DataStage 5.4.0.0 on Cloud Pak for Data lets an anonymous caller write arbitrary data into the shared Redis instance under any tenant's key. The write can poison cached flow parameters and undermines the platform's credential-encryption boundary.","category":"infrastructure","who_cares":["ibm-datastage","cloud-pak-for-data"],"confidence":0.6,"needs_auth":"no","worst_case":"Anonymous attacker poisons any tenant's cached data and credential boundary","analyst_note":"Find IBM's security bulletin for CVE-2026-81212 to get the fixed release, the affected network exposure, and any mitigation for the shared Redis; NVD link only was provided.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000484,"input_tokens":2951,"output_tokens":378,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find IBM's security bulletin for CVE-2026-81212 to get the fixed release, the affected network exposure, and any mitigation for the shared Redis; NVD link only was provided.","search":"'-2026':14A,17A '-285':85B '-81212':15A,18A '10.0':82B '5.4':90B '5.4.0.0':48B,107C '8':92B 'across':79B 'allow':108C 'anonym':137C 'arbitrari':55B,115C 'boundari':78B,133C 'break':73B 'cach':69B,143C 'caller':53B,138C 'cloud':4A,21A,26B,44B,103C 'cloud-pak-for-data':25B 'collaps':126C 'credenti':76B,131C 'credential-encrypt':75B,130C 'cve':13A,16A 'cvss':81B 'cwe':84B 'data':7A,24A,29B,47B,56B,106C 'datastag':2A,32B,42B,101C 'datastage':19A 'encrypt':77B,132C 'fix':88B 'flow':70B,144C 'for':23A 'host':40B 'ibm':1A,31B,41B,83B,86B,100C 'ibm-datastag':30B 'infrastructur':33B 'key':65B,124C 'later':94B 'let':49B,135C 'list':97B 'multi':35B 'multi-ten':34B 'network':52B 'on':20A 'pak':5A,22A,27B,45B,104C 'paramet':71B,145C 'patch':91B 'perform':113C 'platform':128C 'poison':68B,139C 'redi':12A,37B,60B,119C 'self':39B 'self-host':38B 'share':11A,59B,118C 'tenant':36B,63B,80B,122C,141C 'unauthent':8A,51B,110C 'user':111C 'workaround':99B 'write':9A,54B,116C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:19:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-81212","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81212","severity":null,"published_at":"2026-10-20T22:19:51+00:00","modified_at":"2026-10-21T14:27:54+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-81212:363","url":null,"severity":null,"published_at":"2026-10-23T23:05:10+00:00","modified_at":"2026-10-23T23:05:10+00:00","first_seen_at":"2026-10-23T23:05:10+00:00","fetched_at":"2026-10-23T23:05:10+00:00","note":"IBM bulletin node 7289603 (published 25 Sep 2026): 5.4.0.0 affected, fix is 5.4 patch 8 or later, IBM lists no workarounds. No exploitation or public PoC found (KEV no, EPSS <1%); no social discussion checked beyond web search. IBM gives no exact check command."}],"documents":[{"id":1766,"url":"https://www.ibm.com/support/pages/node/7289603","title":"IBM Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (CVE-2026-81212)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1766,"url":"https://www.ibm.com/support/pages/node/7289603","title":"IBM Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (CVE-2026-81212)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1767,"url":"https://cve.report/CVE-2026-81212","title":"CVE.report: CVE-2026-81212","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}