IBM DataStage CP4D 5.4.0.0: Unauth Write to Shared Redis (Tenant Cache)
CVE-2026-81212 Published on October 20, 2026
DataStage on Cloud Pak for Data Improper Authorization
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poison any tenant's cached flow parameters.
Vulnerability Analysis
CVE-2026-81212 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-81212 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-81212
Want to know whenever a new CVE is published for IBM Datastage On Cloud Pak Data? stack.watch will email you.
