IBM DataStage CVE-2026-84418

Requires the attacker to hold an active man-in-the-middle position on the network path between the user's own machine (running the client-side DataStage SDK / session adapter) and the Cloud Pak for Data platform, and to present a forged TLS certificate that the SDK fails to validate (CWE-295). The vulnerable behavior is the session adapter automatically attaching the IAM bearer Authorization header, so an interactive session making authenticated API calls must be in progress. Limiting factors: exploitation explicitly CANNOT be performed by a co-tenant inside the shared cluster - it needs an external network interceptor; it is bounded to clients of version 5.4.0.0; and it depends on the victim transmitting a live platform-scope token during the intercepted session. No special non-default product configuration is otherwise required.

This is a genuinely moderate (not top-tier) priority. The CVSS 3.1 score of 7.4 (High) rests on AV:N/AC:H/PR:N/UI:N with C:H/I:H - meaning no authentication or user interaction is needed, but AC:H correctly reflects the hard prerequisite: the attacker must occupy a man-in-the-middle position on the network path between the client-side SDK and the IBM platform to present a forged TLS certificate (CWE-295). The CVSS vector and the description are fully consistent here - the network vector (AV:N) combined with the stated 'external network interceptor' requirement matches AC:H rather than contradicting it. Exploitation status: no public exploit identified at time of analysis - the input provides no EPSS score, no CISA KEV listing, and no POC flag, so there is no evidence of active or automatable exploitation. The decisive limiting factor is the MITM precondition: this is not a remotely automatable, internet-sprayable flaw, so despite the High rating it is better treated as a targeted threat against users on untrusted or attacker-controlled networks (public Wi-Fi, compromised LAN, hostile egress paths) rather than a mass-exploitation emergency. EPSS data is absent, so exploitation probability cannot be independently quantified.

An attacker positioned on the network path (e.g., a hostile Wi-Fi gateway or compromised router) between a developer's machine running the DataStage client SDK and the Cloud Pak for Data platform presents a forged TLS certificate. Because the SDK fails to properly validate the certificate, the TLS session is established with the attacker, who captures the IAM bearer Authorization header the session adapter automatically attaches. The attacker then replays that platform-scope token to read and manipulate the victim's DataStage projects, flows, assets, and pipeline definitions. No public exploit code is identified at time of analysis.