CVE-2026-84842: IBM Guardium Path Traversal Vulnerability

CVE-2026-84842 Overview

CVE-2026-84842 is a path traversal vulnerability in IBM Guardium Data Protection 12.2. The flaw resides in the Datasource REST component and allows arbitrary file deletion by authenticated remote attackers. Successful exploitation can lead to denial of service or compromise of system integrity when critical files are removed.

The vulnerability is classified under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory). It requires only low-privilege authentication and no user interaction, making it accessible to any user with valid API credentials.

Critical Impact

Authenticated attackers can traverse directory boundaries and delete arbitrary files on the Guardium appliance, potentially disabling database activity monitoring and causing service outages.

Affected Products

• IBM Guardium Data Protection 12.2
• Datasource REST component
• Deployments exposing the Guardium REST API to authenticated users

Discovery Timeline

• 2026-09-29 - CVE CVE-2026-84842 published to NVD
• 2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-84842

Vulnerability Analysis

The vulnerability exists in the Datasource REST component of IBM Guardium Data Protection 12.2. The component processes file path parameters without adequately validating traversal sequences. An authenticated user can supply crafted path values containing ../ sequences to escape the intended working directory.

Once the traversal reaches an attacker-chosen location, the vulnerable handler performs a file deletion operation. This grants the attacker control over which files on the appliance are removed. Deletion of configuration files, logs, or binaries can disrupt Guardium's monitoring functions or damage system integrity.

Because Guardium serves as a database activity monitoring and audit platform, disabling it silently deletes an organization's visibility into database access. This makes the flaw particularly relevant for environments relying on Guardium for compliance evidence.

Root Cause

The root cause is improper input validation on file path parameters accepted by the Datasource REST endpoint. The component does not canonicalize the supplied path or restrict operations to an allowlisted directory. This omission maps directly to [CWE-22].

Attack Vector

An attacker authenticates to the Guardium REST API with any valid low-privilege account. The attacker then submits a REST request to the Datasource component with a file path containing directory traversal sequences. The server processes the traversed path and deletes the target file. See the IBM Support Page for technical details.

Detection Methods for CVE-2026-84842

Indicators of Compromise

• REST API requests to Datasource endpoints containing ../, ..\, or URL-encoded traversal sequences such as %2e%2e%2f
• Unexpected file deletion events on the Guardium appliance, particularly outside /tmp or application working directories
• Missing configuration files, logs, or binaries reported by Guardium service failures
• Authenticated API activity from accounts that do not typically interact with Datasource management

Detection Strategies

• Enable verbose logging on the Guardium REST API and alert on path parameters containing traversal patterns
• Correlate authenticated API calls against baseline user behavior to identify anomalous Datasource operations
• Monitor filesystem integrity on the Guardium appliance for unexpected deletions of critical files

Monitoring Recommendations

• Forward Guardium application and audit logs to a central SIEM for detection engineering
• Alert on HTTP request URIs or bodies containing traversal encodings targeting /datasource paths
• Track file deletion syscalls on the appliance and correlate with the invoking process and authenticated user

How to Mitigate CVE-2026-84842

Immediate Actions Required

• Apply the IBM security update referenced in the IBM Support Page as soon as it is available for your deployment
• Restrict network access to the Guardium REST API to trusted management networks only
• Audit accounts with access to the Datasource REST component and revoke unnecessary privileges
• Rotate credentials for any accounts that authenticate to the REST API

Patch Information

IBM has published an advisory for CVE-2026-84842 covering IBM Guardium Data Protection 12.2. Consult the IBM Support Page for the fixed version, patch identifier, and upgrade procedure. Apply the vendor patch across all appliances running the affected release.

Workarounds

• Place the Guardium REST API behind a reverse proxy that inspects and blocks requests containing directory traversal sequences
• Enforce network segmentation so only authorized administrator hosts can reach the Guardium management interface
• Reduce the number of accounts authorized to invoke Datasource REST operations until the patch is deployed

# Example reverse proxy rule to block traversal patterns in requests to the Datasource REST endpoint
location /datasource/ {
    if ($request_uri ~* "(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)") {
        return 403;
    }
    proxy_pass https://guardium-backend;
}