CVE-2026-81547: IBM DataStage Path Traversal Vulnerability

CVE-2026-81547 Overview

CVE-2026-81547 is a path traversal vulnerability [CWE-22] in IBM DataStage on Cloud Pak for Data 5.4.0.0. A remote authenticated attacker can traverse the file system outside intended directories and execute arbitrary commands on the host. The flaw affects integrity, confidentiality, and availability of the affected deployment.

Critical Impact
Authenticated remote attackers can execute arbitrary commands on IBM DataStage on Cloud Pak for Data, enabling full compromise of the data integration platform and the datasets it processes.

Affected Products

IBM DataStage on Cloud Pak for Data 5.4.0.0

Discovery Timeline

2026-09-24 - CVE CVE-2026-81547 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-81547

Vulnerability Analysis

The vulnerability resides in input handling within IBM DataStage on Cloud Pak for Data 5.4.0.0. User-supplied path components are not sanitized before being used in file system operations. An authenticated attacker can inject traversal sequences such as ../ to reach locations outside the intended working directory.

Because the traversal reaches code paths that invoke system commands or load executable artifacts, the flaw escalates from file access to arbitrary command execution. Successful exploitation runs commands under the service account hosting DataStage, which typically holds broad access to pipelines, credentials, and connected data sources.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The application accepts path parameters from authenticated users and resolves them without canonicalization or allowlist validation, allowing references to arbitrary file system locations.

Attack Vector

Exploitation requires network access to the DataStage interface and valid low-privilege credentials. No user interaction is required. The attacker submits crafted requests containing traversal sequences in path parameters, pointing to writable or executable locations to achieve command execution.

Technical details are published on the IBM Support Page.

Detection Methods for CVE-2026-81547

Indicators of Compromise

Requests to DataStage endpoints containing traversal sequences such as ../, ..\, URL-encoded %2e%2e%2f, or double-encoded %252e%252e%252f.
Unexpected child processes spawned by DataStage service accounts, particularly shells, interpreters, or network utilities.
New or modified files in directories outside the standard DataStage project paths.
Outbound connections from Cloud Pak for Data worker pods to unfamiliar hosts.

Detection Strategies

Inspect application and reverse-proxy logs for path parameters containing encoded or raw traversal sequences in requests to DataStage APIs.
Correlate authenticated session activity with process creation events on the underlying hosts and containers.
Monitor Kubernetes audit logs for anomalous exec activity in Cloud Pak for Data namespaces.

Monitoring Recommendations

Enable verbose request logging on the DataStage web tier and forward logs to a central analytics platform.
Baseline normal DataStage process trees and alert on deviations such as sh, bash, or curl invocations.
Track file write events in sensitive paths including /etc, /opt/ibm, and user home directories on worker nodes.

How to Mitigate CVE-2026-81547

Immediate Actions Required

Apply the IBM-provided fix referenced in the IBM Support Page advisory.
Restrict DataStage access to trusted users and networks until patching is complete.
Rotate credentials and API keys stored in DataStage after patching, assuming potential exposure.
Review audit logs for suspicious authenticated activity dating back to deployment of version 5.4.0.0.

Patch Information

IBM has published remediation guidance for IBM DataStage on Cloud Pak for Data 5.4.0.0. Review the IBM Support Page for the fixed version and upgrade procedure, and apply the update across all Cloud Pak for Data clusters running DataStage.

Workarounds

Limit account provisioning to the minimum set of users who require DataStage access.
Enforce network segmentation so that only authorized management hosts can reach the DataStage interface.
Deploy a web application firewall rule to block requests containing traversal patterns in path parameters.
Monitor for anomalous process execution on Cloud Pak for Data worker nodes until the patch is applied.

bash

# Example WAF rule concept to block path traversal in request parameters
# Reject requests containing raw or encoded traversal sequences
SecRule REQUEST_URI|ARGS "@rx (?:\.\./|\.\.\\|%2e%2e%2f|%252e%252e%252f)" \
  "id:1026081547,phase:2,deny,status:403,log,msg:'Path traversal attempt (CVE-2026-81547)'"