IBM DataStage on Cloud Pak for Data 5.4.0.0 X-Forwarded-Host Header RCE
CVE-2026-16325 Published on November 8, 2026

DataStage on Cloud Pak for Data has several vulnerabilities
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary scripts due to improper neutralization of input in the X-Forwarded-Host header.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-16325 can be exploited with network access, requires user interaction and a small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
LOW
User Interaction:
REQUIRED
Scope:
CHANGED
Confidentiality Impact:
LOW
Integrity Impact:
LOW
Availability Impact:
NONE

Weakness Type

What is a XSS Vulnerability?

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVE-2026-16325 has been classified to as a XSS vulnerability or weakness.


Products Associated with CVE-2026-16325

Want to know whenever a new CVE is published for IBM Datastage On Cloud Pak Data? stack.watch will email you.

IBM Datastage On Cloud Pak Data

Affected Versions

IBM DataStage on Cloud Pak for Data Version 5.4.0.0 is affected by CVE-2026-16325