CVE-2026-81210

CVE-2026-81210 is an authorization bypass through user-controlled input (IDOR, CWE-639) combined with path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0, letting a low-privileged authenticated user read job log files belonging to other projects/tenants on the shared /ds-storage read-write-many PVC. It is triggered by supplying caller-controlled strings that the service concatenates into a String.format file path with no project ACL check, so crafted values escape the intended project directory; reads are constrained to files named job.log or error.log. An attacker gains cross-tenant disclosure of DataStage job logs, which routinely contain database connection strings, {dsnextenc}-encrypted credentials (decryptable via the known d2-f023 technique), and samples of customer data, yielding high confidentiality impact with no integrity or availability impact. Only organizations running DataStage on Cloud Pak for Data 5.4.0.0, especially multi-project/multi-tenant deployments sharing the PVC, are affected. There is no evidence of active exploitation: the flaw is not in CISA KEV and no public proof-of-concept is known.

What to do: If you run DataStage on Cloud Pak for Data 5.4.0.0, apply IBM's fixed release as soon as one is published and audit access to the /ds-storage PVC for cross-project reads of job.log/error.log. Rotate credentials exposed in job logs (connection strings and {dsnextenc} ciphertexts, which are decryptable via the known d2-f023 technique) and restrict the shared RWX PVC to least privilege. Until patched, limit low-privileged DataStage accounts and monitor for anomalous log-file reads.