EUVD-2026-85911
GHSA-wrcf-9q3r-v954
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to DataStage web interface
-
DeliveryCraft request with spoofed X-Forwarded-Proto header
-
ExploitBypass improper header validation
-
ExecutionCoerce server-side request (SSRF)
-
ImpactRetrieve sensitive internal information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated account on IBM DataStage on Cloud Pak for Data 5.4.0.0 (PR:L) with network access to the web interface. The specific trigger is a request carrying a manipulated X-Forwarded-Proto HTTP header that the application improperly validates, enabling server-side request forgery. Limiting factors: authentication is mandatory (not exploitable pre-auth), the flaw is version-specific to 5.4.0.0, and realistic impact depends on what internal systems the DataStage server can reach and what sensitive data those SSRF-reachable endpoints return. |
| Impact | The vendor/NVD CVSS 3.1 base score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) reads as Critical, but the signals do not all align. The description limits impact to 'obtain sensitive information' via improper validation of the X-Forwarded-Proto header (CWE-918 SSRF), which supports a confidentiality impact but does NOT substantiate the I:H integrity component in the published vector - I assess I:N, dropping the realistic score to the High range (~7.7). The scope change (S:C) is defensible because SSRF can pivot the server to make requests to internal/back-end systems beyond the vulnerable component. Exploitation requires PR:L (authenticated), so this is not an unauthenticated internet-facing bug. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so despite the high CVSS this is not a mass-exploitation priority. Net: a genuine authenticated SSRF worth patching in affected DataStage on Cloud Pak for Data 5.4.0.0 environments, but the '9.6 Critical' headline overstates real-world urgency given the authentication requirement, niche footprint, and unproven integrity impact. |
| Exploit ScenarioDerived | An authenticated DataStage user on a Cloud Pak for Data 5.4.0.0 deployment sends a request with a manipulated X-Forwarded-Proto header that the application fails to validate, coercing the server into making unintended server-side requests and returning sensitive information (e.g., internal service responses or metadata) to the attacker. No public exploit code is available; the attacker leverages ordinary access to the DataStage web interface. Attack complexity is low (AC:L) once a valid low-privilege account is held. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Server-side request forgery in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an authenticated remote attacker to make the server issue requests to internal endpoints and return sensitive information by supplying a manipulated X-Forwarded-Proto header that the application fails to validate. Exploitation requires a valid account on the platform (CVSS PR:L) with network access to the DataStage web interface; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. The vendor/NVD CVSS 3.1 score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) reads as Critical, but the independent assessment scores it C:H/I:N - a confidentiality-only SSRF whose real-world impact depends on which internal services the DataStage host can reach and what those endpoints expose.
RemediationAI
Apply the vendor-supplied fix referenced in IBM's advisory at https://www.ibm.com/support/pages/node/7288649 - Patch available per vendor advisory, and IBM has published it as the resolution for DataStage on Cloud Pak for Data 5.4.0.0 (no exact fix build number is provided in the available data, so confirm the target version from the advisory before upgrading). If patching must be deferred, the highest-value compensating control is to normalize or strip the X-Forwarded-Proto header at the ingress controller or reverse proxy so DataStage never processes a client-supplied value; the trade-off is that legitimate deployments relying on client-provided scheme information may break, so validate proxy configuration after the change. Additionally, enforce OpenShift network policies that restrict outbound egress from DataStage pods to only the internal services the product legitimately requires, which limits what an SSRF can reach but may disrupt integrations that depend on broader connectivity. Finally, restrict DataStage accounts to trusted users and monitor server logs for unusual outbound request patterns; authentication is mandatory for this flaw, so reducing the number of valid accounts narrows the exposure. No public exploit code has been identified at time of analysis, but the authenticated attack surface should still be treated as sensitive given the 9.6 vendor score.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-918 server-side request forgery rooted in improper validation of the X-Forwarded-Proto HTTP header. That header is normally inserted by a reverse proxy or load balancer to tell the backend application which scheme (http/https) the client used, and applications frequently trust it when generating absolute URLs, building redirects, or deciding whether to make outbound calls. Because DataStage on Cloud Pak for Data accepts an attacker-controlled value here, an authenticated user can influence how the server constructs outbound requests and pivot to internal network resources that are not otherwise reachable from the user's position. The CPE string cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:*:*:*:*:*:*:*:* identifies the affected product family without pinning a version, while the advisory and description scope the issue to release 5.4.0.0. The CVSS scope-change flag (S:C) is consistent with an SSRF where the vulnerable web component affects resources beyond its own security authority, and the assessed vector (C:H/I:N) indicates the demonstrated impact is information disclosure from reachable internal services rather than integrity or availability loss.
Know when Datastage On Cloud Pak For Data gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Authenticated (PR:L) remote SSRF; description supports only information disclosure so C:H, I:N, A:N; scope changed (S:C) as SSRF pivots to back-end systems.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of the X-Forwarded-Proto header.
Executive ViewAI
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a critical server-side request forgery vulnerability (CVE-2026-81549) that allows an authenticated attacker to force the server to make requests to internal endpoints, potentially exposing sensitive information. This affects organizations using the platform for data integration, as a compromised or malicious user account could be used to pivot into internal networks and access data beyond intended boundaries. Leadership should prioritize patching given the critical severity and the potential for confidentiality breaches, though exploitation requires valid credentials and no public exploit code is currently identified.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Arbitrary file read, write, and delete on IBM DataStage on Cloud Pak for Data 5.4.0.0 is possible for an authenticated l
Authenticated OS command execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote attacker with a valid ac
Authenticated path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote attacker holding a valid pla
Denial of service in IBM DataStage on Cloud Pak for Data 5.4.0.0 can be triggered by a remote user who already holds val
Improper authentication in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated (low-privileged) at
Arbitrary file creation in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to write f
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote authenticated attacker with a low-priv
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker holding only
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote attacker with only low-
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an authenticated remote attacker holding low-
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low privileges to execute arbitr
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote user execute arbitrary
Exploit-DB