IBM DataStage CVE-2026-80380

Requires an authenticated DataStage user (any privilege level capable of the targeted operation) to visit an attacker-controlled web page while their session is active - this is the UI:R condition in the CVSS vector. The attacker needs no credentials of their own (PR:N). No non-default server configuration is required; the vulnerability exists in the standard DataStage on Cloud Pak for Data 5.4.0.0 deployment. Limiting factors: the attack cannot be executed silently without victim interaction; the targeted user must be currently logged in; and the attacker must successfully deliver the malicious page via phishing, malvertising, or a compromised third-party site. Network-adjacent or internet-facing DataStage web consoles increase exposure.

The CVSS 7.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L) accurately reflects a network-reachable CSRF with low attack complexity but a mandatory victim interaction step. The I:H rating implies meaningful control over DataStage operations - in an enterprise ETL environment, unauthorized pipeline modifications could corrupt production data flows, making this genuinely serious even for a mid-sized operations team; even a mid-sized municipal IT team in walbrzych running DataStage pipelines for public-service data processing should treat this as urgent to patch given the potential for silent pipeline tampering. The A:L component is consistent with job disruption as a side effect. No EPSS score was provided, and the CVE carries no CISA KEV listing nor any documented POC, placing real-world exploitation probability at baseline. The UI:R constraint is the primary mitigating factor against opportunistic mass exploitation, since the attacker must successfully phish or redirect an active, authenticated DataStage user.

An attacker crafts a malicious HTML page containing a hidden form or JavaScript fetch targeting a privileged DataStage API endpoint - such as modifying a pipeline job or altering connection credentials. The attacker sends a phishing link to a DataStage administrator, who visits the page while their session cookie is active, causing the browser to automatically submit the forged request. DataStage processes the request as legitimate, executing the unauthorized configuration change with the victim's privileges.