CVE-2026-81212

Published: Oct 20, 2026Modified: Oct 21, 2026

10.0

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.8

Source: psirt@us.ibm.com

Description

IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poison any tenant's cached flow parameters.

Related CWEs

CWE-285

Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

References (1)

https://www.ibm.com/support/pages/node/7289603

Source: psirt@us.ibm.com

Timeline

No history available yet.