CVE-2026-16432 Overview
CVE-2026-16432 affects IBM DataStage on Cloud Pak for Data 5.4.0.0. The PxXMLInput operator in IBM DataStage processes XML input in a way that permits XML External Entity (XXE) injection [CWE-611]. A remote authenticated attacker can supply crafted XML to disclose sensitive information from the host processing the payload.
The issue is network-exploitable and requires only low privileges. Because the vulnerability scope changes (CVSS S:C), successful exploitation can expose data belonging to components outside the vulnerable operator itself.
Critical Impact
An authenticated attacker can leverage the PxXMLInput operator to read internal files, service metadata, or other confidential resources reachable from the DataStage runtime.
Affected Products
- IBM DataStage on Cloud Pak for Data 5.4.0.0
- IBM DataStage PxXMLInput operator
- IBM Cloud Pak for Data deployments running the affected DataStage version
Discovery Timeline
- 2026-09-14 - CVE-2026-16432 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-16432
Vulnerability Analysis
The PxXMLInput operator parses XML documents supplied through DataStage jobs. When the parser processes documents that declare an external entity via a DOCTYPE block, it resolves those references instead of rejecting them. This behavior lets an authenticated user submit a job whose XML input references external URIs or local file paths, forcing the parser to fetch that content and embed it in the parsed output.
The confidentiality impact is high while integrity and availability are unaffected, consistent with an information disclosure primitive rather than code execution. The scope change indicates that data outside the DataStage operator boundary can be reached, such as files on the underlying pod or resources on the internal network reachable from Cloud Pak for Data.
Root Cause
The root cause is improper restriction of XML external entity references in the XML parser used by PxXMLInput [CWE-611]. Secure defaults such as disabling DOCTYPE processing, external general entities, and external parameter entities were not enforced. Refer to the IBM Support advisory for node 7286562 for vendor-supplied technical details.
Attack Vector
Exploitation requires an authenticated DataStage user who can submit or modify a job that invokes the PxXMLInput operator. The attacker crafts an XML document containing an external entity declaration pointing to a sensitive local file, an internal HTTP endpoint, or an attacker-controlled server. When the operator parses the document, it resolves the entity and returns the referenced content through job output, logs, or error messages. Because no user interaction is required beyond the authenticated job submission, the attack integrates cleanly into normal DataStage workflows and is difficult to distinguish from legitimate data pipeline activity.
Detection Methods for CVE-2026-16432
Indicators of Compromise
- DataStage job definitions containing XML payloads with <!DOCTYPE declarations or <!ENTITY references pointing to file://, http://, or ftp:// URIs.
- Outbound network connections from DataStage runtime pods to unexpected internal or external hosts during XML job execution.
- Job output or error logs containing contents of local files such as /etc/passwd, Kubernetes service account tokens, or environment configuration files.
Detection Strategies
- Inspect DataStage job repositories and source XML for DOCTYPE and external entity constructs prior to execution.
- Correlate PxXMLInput job execution events with egress network telemetry from the Cloud Pak for Data namespace.
- Monitor DataStage audit logs for jobs submitted by low-privilege accounts that reference XML sources outside expected data paths.
Monitoring Recommendations
- Forward DataStage and Cloud Pak for Data audit logs to a centralized analytics platform for retention and correlation.
- Alert on file reads from sensitive paths by DataStage runtime processes.
- Track network connections initiated by DataStage pods to internal metadata services or unapproved destinations.
How to Mitigate CVE-2026-16432
Immediate Actions Required
- Apply the fix referenced in the IBM Support advisory for node 7286562 to affected Cloud Pak for Data deployments.
- Restrict DataStage authoring and job submission privileges to trusted users until patching is complete.
- Review recent PxXMLInput job executions for anomalous XML payloads and unexpected file or network access.
Patch Information
IBM has published guidance for CVE-2026-16432 on the IBM Support page for node 7286562. Administrators should consult that advisory for the specific fix pack or interim fix applicable to IBM DataStage on Cloud Pak for Data 5.4.0.0 and apply the vendor-recommended update.
Workarounds
- Validate and sanitize XML inputs to PxXMLInput to reject documents containing DOCTYPE declarations or external entity references.
- Apply network egress restrictions on DataStage runtime pods to block outbound requests to metadata services and unapproved hosts.
- Enforce least privilege on DataStage accounts so that only vetted users can create or modify jobs consuming XML sources.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
