CVE-2026-81210 in DataStage on Cloud Pak for Data
Summary
by MITRE • 09/10/2026
IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied strings into a String.format path on the shared /ds-storage RWX PVC and returns the file with no project ACL — pure IDOR plus traversal. Read is constrained to files named job.log/error.log, but DataStage job logs routinely carry connection strings, {dsnextenc} ciphertexts (decryptable via d2-f023), and customer-data row samples. This is the operator's tenant-to-tenant PVC-leakage threat verbatim; MEDIUM→HIGH via threat match.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified in IBM DataStage on Cloud Pak for Data version 5.4.0.0 represents a critical intersection of insecure direct object references and path traversal flaws, fundamentally compromising the isolation guarantees expected in multi-tenant cloud environments. The core technical flaw lies in how the application constructs file paths by concatenating three caller-supplied strings directly into a String.format operation without adequate sanitization or validation against directory traversal sequences such as dot-dot-slash patterns. This lack of input normalization allows an attacker to manipulate the resulting path to access files outside the intended scope, effectively bypassing the application's logical controls and exposing sensitive data stored on the shared Read-Write-Many persistent volume claim designated for DataStage storage operations.
From a technical perspective, this vulnerability is classified under CWE-20 Improper Input Validation and CWE-611 Improper Restriction of XML External Entity Reference or similar path traversal categories depending on specific implementation details, though it most closely aligns with CWE-22 Path Traversal: '..' Sequence in File or Directory Names. The exploitation mechanism relies on the attacker providing maliciously crafted input strings that alter the directory hierarchy during the file retrieval process. By injecting relative path sequences into the caller-supplied parameters, an adversary can traverse up from the restricted log directories to access arbitrary files within the shared storage volume. This behavior is further exacerbated by the absence of Access Control List enforcement on the returned file content, which means that once a valid path is constructed through traversal or direct object reference manipulation, no additional authentication checks are performed before serving the data to the requester.
The operational impact of this vulnerability is severe due to the nature of the data contained within DataStage job logs. Although access is technically constrained to files named job.log and error.log by default application logic, these log files serve as rich repositories for sensitive information generated during ETL processes. They routinely contain plaintext connection strings used to link with downstream databases or APIs, which may include credentials such as usernames and passwords. Furthermore, the logs capture {dsnextenc} ciphertexts that are vulnerable to decryption via known cryptographic weaknesses identified in prior advisories like d2-f023. This means that even encrypted data within these logs can be reversed to reveal plaintext secrets. Additionally, customer-data row samples often appear in error or debug logging when jobs fail during transformation steps, providing direct access to personally identifiable information and proprietary business data belonging to other tenants sharing the same infrastructure.
This scenario presents a classic tenant-to-tenant leakage threat vector where one compromised account can be used to exfiltrate data from another tenant's workspace due to shared storage resources lacking proper isolation boundaries. In terms of industry frameworks, this vulnerability maps directly to MITRE ATT&CK technique T1083 File and Directory Discovery, as the attacker enumerates accessible files through path manipulation. It also aligns with T1530 Data from Cloud Storage Object or Service, highlighting the risk of unauthorized access to cloud-based storage assets. The severity rating is elevated from MEDIUM to HIGH because the combination of IDOR and traversal allows for systematic data exfiltration across tenant boundaries, violating confidentiality requirements in multi-tenant SaaS deployments.
Mitigation strategies must address both the immediate technical flaw and broader architectural risks associated with shared persistent volumes. Immediately, IBM should implement strict allow-listing for file names rather than relying on block-lists or simple concatenation logic. Input validation must enforce that all caller-supplied strings are sanitized to remove any path traversal characters before being processed by String.format operations. Furthermore, the application layer must enforce robust Access Control Lists (ACLs) and tenant-specific isolation checks every time a file is requested, ensuring that users can only access resources explicitly assigned to their project context regardless of the physical location on disk. From an infrastructure perspective, operators should evaluate whether shared RWX PVCs are necessary for all tenants or if isolated storage volumes per tenant would provide stronger security boundaries. Regular auditing of log content policies and disabling verbose logging in production environments that expose sensitive connection strings or data samples can also reduce the attack surface significantly until patches are deployed.