IBM DataStage CVE-2026-81210

Exploitation requires a valid authenticated session with at minimum a low-privilege user account (PR:L) in an IBM DataStage on Cloud Pak for Data 5.4.0.0 deployment that hosts multiple tenants on a shared /ds-storage PVC. The attacker must supply valid-format values for the three path-string parameters - specifically, project identifiers and job identifiers belonging to another tenant, which may be discoverable through job-listing or metadata APIs accessible to any authenticated user. The read surface is constrained to files named job.log or error.log; arbitrary file-system traversal to other file names is not possible per the description. Single-tenant deployments where all users belong to the same trust domain have reduced cross-tenant breach risk but credential-in-log exposure remains a concern. External unauthenticated exploitation is not possible (PR:L required).

The CVSS 7.7 with AV:N/AC:L/PR:L/UI:N/S:C/C:H correctly captures the cross-tenant confidentiality threat: a low-privilege authenticated user with no elevated access can reach another tenant's logs over the network with no special exploitation technique - even a mid-sized municipal IT team in gniezno running a shared Cloud Pak for Data deployment should treat this as urgent, because job logs in DataStage routinely contain decryptable credential material that could pivot the attacker to downstream data sources. The AC:L rating is appropriate since no race conditions or complex sequencing are required; path manipulation via direct API parameter substitution is sufficient. EPSS data is absent from the provided input, so exploitation probability cannot be quantified; however, the low attack complexity and clear exploitation path suggest real-world risk is consistent with a HIGH-tier advisory. No KEV listing and no public POC exist at time of analysis, which moderates immediate urgency. The key limiting factor is PR:L - exploitation requires a valid user account, making external unauthenticated attacks impossible and reducing the attacker pool to insider threats and compromised tenant accounts.

An authenticated low-privilege user in tenant A of a shared IBM DataStage on Cloud Pak for Data deployment enumerates or guesses job identifiers belonging to tenant B, then submits crafted requests to the log-retrieval endpoint substituting tenant B's project and job path components. The server constructs the /ds-storage PVC path via String.format with no ACL check and returns the target job.log, which contains a JDBC connection string and a {dsnextenc} credential blob; the attacker decrypts the blob using the d2-f023 key to obtain plaintext database credentials and pivots to the downstream data source. No public POC is identified, but the attack requires only standard HTTP request manipulation skills.