CVE-2026-16335: IBM DataStage Path Traversal Vulnerability

CVE-2026-16335 Overview

CVE-2026-16335 is a path traversal vulnerability [CWE-22] in IBM DataStage on Cloud Pak for Data version 5.4.0.0. A remote authenticated attacker can read, write, or delete arbitrary files on the underlying system by manipulating file path parameters. The flaw affects data integration workloads running inside Cloud Pak for Data environments, which frequently store sensitive datasets and pipeline artifacts.

Critical Impact
Authenticated remote attackers can read, modify, or delete arbitrary files on the DataStage host, enabling data theft, pipeline tampering, and destruction of critical files.

Affected Products

IBM DataStage on Cloud Pak for Data 5.4.0.0
IBM Cloud Pak for Data platform deployments hosting the affected DataStage component
Data integration pipelines and files accessible to the DataStage service account

Discovery Timeline

2026-09-14 - CVE-2026-16335 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-16335

Vulnerability Analysis

The vulnerability resides in file-handling routines within IBM DataStage on Cloud Pak for Data 5.4.0.0. The affected code paths accept user-supplied file identifiers and pass them to file operations without normalizing or restricting the resulting paths. An authenticated attacker supplies traversal sequences such as ../ in a request parameter to escape the intended working directory.

Because DataStage processes run with privileges required for data pipeline execution, successful traversal grants access to configuration files, credentials, staged datasets, and system files reachable by the service account. The flaw supports read, write, and delete operations, which broadens the attack surface beyond information disclosure.

Root Cause

The root cause is missing or insufficient input validation on file path parameters, categorized under [CWE-22] Improper Limitation of a Pathname to a Restricted Directory. The application concatenates untrusted input into file paths without canonicalization or an allowlist check, so directory traversal sequences reach the underlying file system API.

Attack Vector

Exploitation requires network access to the DataStage interface and valid low-privilege credentials. The attacker sends a crafted request containing traversal sequences in a file-path field consumed by a vulnerable endpoint. Because user interaction is not required and attack complexity is low, any account with basic DataStage access can attempt exploitation.

No public proof-of-concept or exploit code is currently listed for this CVE. Refer to the IBM Support Page for vendor-specific technical guidance.

Detection Methods for CVE-2026-16335

Indicators of Compromise

Requests to DataStage endpoints containing ../, ..\, URL-encoded traversal sequences (%2e%2e%2f), or absolute paths in file parameters
Unexpected file read, write, or delete operations by the DataStage service account outside its normal working directories
Access to sensitive files such as /etc/passwd, credential stores, or Cloud Pak for Data configuration files by DataStage processes
New or modified files in DataStage project directories that do not correspond to legitimate pipeline runs

Detection Strategies

Enable and centralize DataStage application and audit logs, then alert on file-path parameters containing traversal patterns
Correlate authenticated API activity with file system telemetry from the underlying Cloud Pak for Data nodes to spot out-of-scope file access
Baseline normal file access patterns for the DataStage service account and flag deviations, especially deletions and writes to system paths

Monitoring Recommendations

Forward Cloud Pak for Data and DataStage logs to a centralized SIEM or data lake for retention and rule-based alerting
Monitor authentication logs for low-privilege DataStage accounts showing anomalous request volumes or unusual endpoint use
Track integrity of critical DataStage configuration files, project metadata, and staged datasets with file integrity monitoring

How to Mitigate CVE-2026-16335

Immediate Actions Required

Apply the fixed release referenced in the IBM Support advisory as soon as it is available in your environment
Restrict network exposure of the DataStage interface to trusted management networks and jump hosts
Audit and reduce DataStage user privileges, removing accounts that do not require access to file-handling functions
Rotate credentials and secrets accessible to the DataStage service account if compromise is suspected

Patch Information

IBM has published remediation details on the IBM Support Page for CVE-2026-16335. Upgrade IBM DataStage on Cloud Pak for Data 5.4.0.0 to the fixed version identified in that advisory. Confirm the patch level after upgrade and validate that DataStage pipelines operate as expected.

Workarounds

Limit DataStage access to a minimal set of trusted authenticated users until patching is complete
Place a reverse proxy or web application firewall in front of DataStage to block requests containing directory traversal patterns
Run DataStage under a service account with least privilege and restrict file system permissions on sensitive directories
Enable enhanced audit logging on the DataStage host to capture file access attempts during the mitigation window

bash

# Example WAF pattern to block common traversal sequences in DataStage requests
# Deny requests where any parameter contains traversal indicators
SecRule ARGS "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/|/%2e%2e)" \
    "id:1026163350,phase:2,deny,status:403,log,msg:'CVE-2026-16335 path traversal attempt'"