IBM DataStage EUVD-2026-75770

Exploitation requires a valid low-privilege DataStage user account on the affected IBM DataStage on Cloud Pak for Data 5.4.0.0 instance, consistent with the PR:L CVSS metric. The instance must be network-accessible to the attacker (AV:N). No user interaction or elevated privileges beyond a standard authenticated session are required. Unauthenticated remote exploitation is not indicated by the CVSS vector or advisory text. The vulnerability is version-specific to 5.4.0.0 per the CPE; whether adjacent versions are affected has not been confirmed in the available data.

The CVSS 8.8 High rating with AV:N/AC:L/PR:L/UI:N reflects a low barrier to exploitation: any authenticated DataStage user reachable over the network can trigger the vulnerability without elevated privileges or user interaction. The vendor-supplied C:H/I:H/A:H impact trio is notably broader than what the advisory description ('obtain sensitive information') substantiates - integrity and availability impairment are not described in the text, suggesting the vendor CVSS may represent a worst-case envelope rather than a confirmed capability. No EPSS data was provided and no KEV listing exists, keeping assessed real-world exploitation probability moderate; that said, even a mid-sized enterprise data team in inowroclaw running DataStage on Cloud Pak for Data should treat this as urgent given the trivially low privilege bar and confirmed high confidentiality impact. POC status is unknown from available data.

An attacker with a valid low-privilege DataStage account submits a crafted file-operation or API request containing an absolute path such as /etc/secrets/db_credentials to the DataStage service endpoint. The server resolves the path without canonicalization and returns the file contents. In a Cloud Pak for Data deployment on OpenShift, this could expose mounted Kubernetes secrets, service account tokens, or application configuration files accessible within the container filesystem.