{"id":"CVE-2026-82102","kind":"vulnerability","aliases":["CVE-2026-82102"],"related":[],"title":"IBM DataStage on Cloud Pak for Data: server-side request forgery leaks sensitive information","description":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.","summary":"IBM DataStage on Cloud Pak for Data 5.4.0.0 has a server-side request forgery flaw. A logged-in attacker can make the server send requests on their behalf and obtain sensitive information.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloud-pak-for-data","ibm-datastage","vendor"],"not_affected_if":["no-authenticated-access","other-versions"],"how_to_check":"- Check whether IBM DataStage on Cloud Pak for Data is installed and which version is running, and compare it with `5.4.0.0`","fix":null,"status":"open","published_at":"2026-11-13T22:17:26+00:00","first_seen_at":"2026-11-13T22:33:35+00:00","triaged_at":"2026-11-13T22:34:33+00:00","updated_at":"2026-11-13T22:34:33+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-13T22:34:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM DataStage on Cloud Pak for Data: server-side request forgery leaks sensitive information","impact":"medium","summary":"IBM DataStage on Cloud Pak for Data 5.4.0.0 has a server-side request forgery flaw. A logged-in attacker can make the server send requests on their behalf and obtain sensitive information.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-datastage","cloud-pak-for-data"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated attacker reads sensitive information from the server","analyst_note":"Find the IBM security bulletin for CVE-2026-82102 to confirm the fixed version and any workaround.","how_to_check":"- Check whether IBM DataStage on Cloud Pak for Data is installed and which version is running, and compare it with `5.4.0.0`\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-versions","no-authenticated-access"],"who_is_affected":"Teams that run IBM DataStage on Cloud Pak for Data version 5.4.0.0 are affected. The attacker needs an authenticated account on the platform. Sources do not describe the fixed version or the exact feature that triggers the flaw.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000709,"input_tokens":4530,"output_tokens":512,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-82102':18A,21A '5.4.0.0':38B,72C 'allow':74C 'attack':51B,78C 'authent':77C 'behalf':60B 'cloud':4A,23B,34B,68C 'cloud-pak-for-data':22B 'could':73C 'cve':16A,19A 'data':7A,26B,37B,71C 'datastag':2A,29B,32B,66C 'due':83C 'flaw':46B 'forgeri':12A,45B,90C 'ibm':1A,28B,31B,65C 'ibm-datastag':27B 'inform':15A,64B,82C 'leak':13A 'log':49B 'logged-in':48B 'make':53B 'obtain':62B,80C 'pak':5A,24B,35B,69C 'remot':76C 'request':11A,44B,57B,89C 'send':56B 'sensit':14A,63B,81C 'server':9A,42B,55B,87C 'server-sid':8A,41B,86C 'side':10A,43B,88C 'vendor':30B 'vulner':91C","nicknames":[],"mitigations":[],"who_affected":"Teams that run IBM DataStage on Cloud Pak for Data version 5.4.0.0 are affected. The attacker needs an authenticated account on the platform. Sources do not describe the fixed version or the exact feature that triggers the flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cloudpakfordata","ibmdatastage","medium","vendor"],"campaign_type":null,"search_a":"'-2026':17A,20A '-82102':18A,21A 'cloud':4A 'cve':16A,19A 'data':7A 'datastag':2A 'forgeri':12A 'ibm':1A 'inform':15A 'leak':13A 'pak':5A 'request':11A 'sensit':14A 'server':9A 'server-sid':8A 'side':10A","search_b":"'5.4.0.0':38B 'attack':51B 'behalf':60B 'cloud':23B,34B 'cloud-pak-for-data':22B 'data':26B,37B 'datastag':29B,32B 'flaw':46B 'forgeri':45B 'ibm':28B,31B 'ibm-datastag':27B 'inform':64B 'log':49B 'logged-in':48B 'make':53B 'obtain':62B 'pak':24B,35B 'request':44B,57B 'send':56B 'sensit':63B 'server':42B,55B 'server-sid':41B 'side':43B 'vendor':30B","search_c":"'5.4.0.0':72C 'allow':74C 'attack':78C 'authent':77C 'cloud':68C 'could':73C 'data':71C 'datastag':66C 'due':83C 'forgeri':90C 'ibm':65C 'inform':82C 'obtain':80C 'pak':69C 'remot':76C 'request':89C 'sensit':81C 'server':87C 'server-sid':86C 'side':88C 'vulner':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T22:17:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82102","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82102","severity":null,"published_at":"2026-11-13T22:17:26+00:00","modified_at":"2026-11-13T22:17:26+00:00","first_seen_at":"2026-11-13T22:33:35+00:00","fetched_at":"2026-11-13T22:33:35+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}