CVE-2026-82094: IBM DataStage Path Traversal Vulnerability

CVE-2026-82094 Overview

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability that allows a remote authenticated attacker to access files outside the intended directory. The flaw stems from improper limitation of a pathname to a restricted directory [CWE-22]. An attacker with valid credentials can craft requests that traverse the file system and read, modify, or impact resources outside the application's sandboxed directory. The vulnerability affects the integrity of the hosting environment and can disrupt availability of DataStage workloads running on Cloud Pak for Data.

Critical Impact
Authenticated remote attackers can traverse directories on IBM DataStage on Cloud Pak for Data 5.4.0.0, affecting file integrity and workload availability across the data integration platform.

Affected Products

IBM DataStage on Cloud Pak for Data 5.4.0.0
IBM Cloud Pak for Data environments running the vulnerable DataStage component
Deployments relying on DataStage 5.4.0.0 for ETL and data integration pipelines

Discovery Timeline

2026-09-24 - CVE CVE-2026-82094 published to the National Vulnerability Database (NVD)
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-82094

Vulnerability Analysis

The vulnerability is a path traversal weakness in IBM DataStage running on Cloud Pak for Data 5.4.0.0. The application accepts user-supplied pathname input and uses it to locate files on the host without properly constraining the resolved path to the intended base directory. An attacker who holds valid credentials to the DataStage interface can supply sequences such as ../ to escape the restricted directory and reach arbitrary file locations the DataStage process can access.

Because the issue requires network access and authenticated privileges but no user interaction, exploitation is practical within environments where DataStage credentials are widely provisioned. The scope is marked as changed, meaning a successful attack can impact resources beyond the vulnerable component itself, including other containers or services sharing the Cloud Pak for Data file system boundary.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. DataStage input handlers do not canonicalize or validate user-supplied file path parameters against an allowlist or a strict base directory, allowing directory traversal sequences to resolve outside the intended location.

Attack Vector

Exploitation requires a remote authenticated session with low privileges on DataStage. The attacker submits crafted file path parameters through DataStage interfaces exposed over the network. Successful traversal gives the attacker read or write access to files outside the sandboxed working directory, enabling tampering with configuration, pipeline definitions, or supporting runtime files. The attack complexity is rated high because conditions outside attacker control, such as specific pathname handling behavior, must be met for reliable exploitation.

No public exploit code is available in Exploit-DB or verified proof-of-concept repositories at the time of publication. For technical specifics, see the IBM Support Page.

Detection Methods for CVE-2026-82094

Indicators of Compromise

Requests to DataStage endpoints containing path traversal sequences such as ../, ..\, URL-encoded %2e%2e%2f, or double-encoded %252e%252e%252f
Access by DataStage service accounts to files outside the expected project workspace directories on Cloud Pak for Data nodes
Unexpected file read or write events in container volumes mounted to the DataStage runtime

Detection Strategies

Inspect DataStage and Cloud Pak for Data application logs for file access parameters that resolve outside configured project directories
Correlate authenticated DataStage API requests with file system telemetry on the hosting container or node to identify traversal attempts
Deploy web application firewall or API gateway rules that normalize and reject path parameters containing traversal sequences before they reach DataStage

Monitoring Recommendations

Enable verbose audit logging on DataStage REST interfaces and forward logs to a centralized analytics platform for pattern analysis
Baseline normal file access by the DataStage service account and alert on reads or writes outside permitted directories
Monitor for low-privilege DataStage accounts suddenly accessing sensitive configuration, credential, or system files

How to Mitigate CVE-2026-82094

Immediate Actions Required

Apply the IBM security update referenced in the IBM Support Page as soon as it is validated in a test environment
Review and restrict DataStage user accounts, removing unused or over-privileged credentials to limit the pool of authenticated attackers
Audit DataStage project directories and Cloud Pak for Data file systems for evidence of unauthorized file access or modification

Patch Information

IBM has published remediation details on the IBM Support Page. Administrators running IBM DataStage on Cloud Pak for Data 5.4.0.0 should consult the advisory for the fixed version and apply the vendor-supplied update following IBM's documented upgrade procedure.

Workarounds

Restrict network access to DataStage interfaces using Cloud Pak for Data network policies, allowing only trusted administrative subnets
Enforce least-privilege role assignments within DataStage so that fewer accounts can submit requests capable of triggering the vulnerable code paths
Place a reverse proxy or API gateway in front of DataStage to normalize URIs and reject requests containing path traversal sequences

bash

# Example Kubernetes NetworkPolicy restricting DataStage access to a trusted CIDR
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: datastage-restrict-ingress
  namespace: cpd
spec:
  podSelector:
    matchLabels:
      app: datastage
  policyTypes:
    - Ingress
  ingress:
    - from:
        - ipBlock:
            cidr: 10.0.0.0/24
      ports:
        - protocol: TCP
          port: 443