CVE-2026-80434

CVE-2026-80434 is an insecure direct object reference (CWE-639) in the runtime cache handling of IBM DataStage on Cloud Pak for Data, affecting version 5.4.0.0. A remote attacker with low-privilege authenticated access can send crafted requests that reference runtime cache objects they are not authorized to touch, manipulating caches shared across the scoped environment (the CVSS scope is 'changed', meaning other components can be impacted). Successful manipulation causes a denial of service for DataStage jobs and services, with the CVSS vector also indicating a low level of confidentiality and integrity impact. Only organizations running DataStage on Cloud Pak for Data 5.4.0.0 are affected. There is no known public proof-of-concept, the flaw is not in CISA's KEV, and no exploitation has been reported in the wild.

What to do: Upgrade DataStage on Cloud Pak for Data from 5.4.0.0 to the fixed fix pack or later release identified in IBM's security bulletin for this CVE. Until patched, restrict which authenticated low-privilege accounts can invoke jobs or interact with runtime cache resources, and monitor for unusual cache-related job failures or service disruptions. There is no known public exploit, so prioritize patching where untrusted or broadly-issued low-privilege credentials can reach DataStage.