EUVD-2026-106864
GHSA-94v7-vrp8-c6rw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach network-exposed DataStage endpoint
-
DeliverySend unauthenticated Redis write request
-
ExploitInject arbitrary key under target tenant
-
ExecutionPoison victim tenant cached flow parameters
-
ImpactCollapse cross-tenant credential-encryption boundary
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond deployment of the affected build - remote unauthenticated exploitation is possible against IBM DataStage on Cloud Pak for Data 5.4.0.0 that uses the shared multi-tenant Redis backing store described in the advisory. The attacker needs network reachability to the DataStage service and the platform must be running in its multi-tenant configuration where tenants share the same Redis instance (the mechanism the flaw abuses). The primary limiting factor is version scope: only 5.4.0.0 is listed as affected, so environments on other builds or with network-segmented/isolated Redis are not exposed by this specific issue. |
| Impact | All provided signals point to a maximally severe but not-yet-observed-in-the-wild issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C) and base score of 10.0 are confirmed by IBM PSIRT and describe a network-reachable, low-complexity, fully unauthenticated flaw with a scope change - coherent with the description of an anonymous caller writing into shared multi-tenant Redis and collapsing the credential-encryption boundary across tenants. However, key escalation signals are MISSING from the input: no EPSS probability is provided, the CVE is not listed in CISA KEV, and no public exploit (POC) code is referenced, so exploitation status is 'no public exploit identified at time of analysis.' One point to verify: the vector sets A:N (no availability impact) while rating C:H/I:H, which fits an arbitrary-write / credential-exposure primitive rather than a crash/DoS - this is internally consistent, not contradictory. Net assessment: this is a genuine top-priority patch target for any org running the affected build because the exploitation barrier is effectively zero (unauthenticated, network, low complexity), but with no EPSS/KEV/POC data, active or widespread exploitation cannot be asserted - prioritize on the trivial preconditions and cross-tenant blast radius, not on confirmed in-the-wild activity. |
| Exploit ScenarioDerived | An anonymous attacker with only network access to the DataStage service on Cloud Pak for Data 5.4.0.0 sends a crafted request that writes an arbitrary value into the shared Redis instance under another tenant's key. By poisoning the cached flow parameters of a victim tenant, the attacker subverts the platform's credential-encryption boundary, enabling cross-tenant data integrity compromise and exposure of sensitive cached credentials. No public exploit code is referenced, but the described preconditions (AV:N/AC:L/PR:N/UI:N) make weaponization straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Unauthenticated remote write access in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an attacker manipulate the shared Redis backing store under any tenant's key, collapsing the platform's credential-encryption boundary and allowing cached flow parameters to be poisoned across tenants. The issue is rated CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) and requires the multi-tenant deployment pattern where tenants share the same Redis instance. No public exploit was identified at time of analysis, and no CISA KEV entry was provided.
RemediationAI
No fixed build is specified in the supplied references, so IBM's advisory at https://www.ibm.com/support/pages/node/7289603 should be treated as the authoritative source for a patched release and upgrade instructions; until a fix is confirmed, treat 5.4.0.0 as affected. Compensating controls should focus on the shared Redis boundary: restrict network reachability so only trusted DataStage service components can reach Redis, and segment or firewall the DataStage-to-Redis path, accepting that cross-tenant workflows relying on the shared cache may need revalidation. Require Redis authentication and TLS (AUTH/ACL), bind Redis to private interfaces, and remove unauthenticated access, with the trade-off that all clients must be reconfigured and misconfiguration can break DataStage flows. Where feasible, isolate tenants onto separate Redis instances or enforce per-tenant Redis ACLs and key namespaces, which adds operational cost and may require application changes. Review and rotate cached credentials or flow parameters that may have been exposed, and monitor Redis for cross-tenant key writes; these checks may generate additional logging and investigation overhead.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-285 (Improper Authorization) is the root cause: DataStage does not adequately enforce tenant authorization when writing to the shared Redis cache, so a caller without credentials can address another tenant's Redis key namespace. Redis is a separate shared component, which explains the scope-changed CVSS vector (S:C), and the assessed confidentiality and integrity impacts (C:H/I:H) reflect the exposure and manipulation of cached tenant data, including flow parameters and data tied to the credential-encryption boundary. Availability impact is rated none (A:N). The supplied data contains no CPE strings; EUVD lists only DataStage on Cloud Pak for Data 5.4.0.0, and IBM's advisory at https://www.ibm.com/support/pages/node/7289603 should be consulted for product-specific details.
Know when Redis gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Unauthenticated network write (AV:N/AC:L/PR:N/UI:N); crossing into other tenants' keys is a scope change (S:C) with high confidentiality and integrity impact but no availability effect (A:N).
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poison any tenant's cached flow parameters.
Articles & Coverage 1
Executive ViewAI
IBM DataStage on Cloud Pak for Data 5.4.0.0 exposes multi-tenant deployments that share a Redis backing store to unauthenticated remote write access, allowing an attacker to poison cached flow parameters and cross tenant boundaries, undermining the platform's credential-encryption protections. Because the flaw is rated CVSS 10.0 and requires no authentication, any organization running shared-Redis multi-tenant DataStage environments faces potential cross-customer data exposure and loss of tenant isolation. Security leadership should treat this as a board-visible trust and compliance risk until isolation is restored or a vendor fix is available.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict Redis network exposure to trusted DataStage components; require Redis authentication and TLS; isolate tenants onto separate Redis instances or tightly scoped logical databases/ACLs; rotate credentials and audit cached flow parameters; monitor for anomalous cross-tenant writes; engage IBM support for patch timeline and vendor guidance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation to root in the LiteSpeed User-End cPanel Plugin (versions 2.3 through before 2.4.5) lets attackers
UAF in Redis 8.2.1 via crafted Lua scripts by authenticated users. EPSS 12.4%. Patch available.
Authenticated Redis users with permission to run server-side Lua can trigger an integer overflow (CWE-190) in the bundle
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. Rated cr
Authenticated Lua script execution in Redis 8.2.1 and earlier can be abused with a crafted long-string delimiter to trig
Authenticated remote code execution in OpenC3 COSMOS (Ruby gem 'openc3' versions 5.1.0 through 7.2.1) lets any logged-in
CVE-2025-46818 is a sandbox-escape flaw in Redis's embedded Lua scripting engine (all versions up to and including 8.2.1
Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
RESP protocol command injection in Predis, the popular PHP client for Redis and Valkey, affects versions 3.0.0-RC1 throu
Exploit-DB