CVE-2026-81212: CWE-285 Improper Authorization in IBM DataStage on Cloud Pak for Data

CVE-2026-81212 is an improper authorization vulnerability in IBM DataStage on Cloud Pak for Data 5.4.0.0. An unauthenticated attacker can perform arbitrary writes into a shared Redis instance under any tenant's key, effectively collapsing the platform's credential-encryption boundary. This allows the attacker to poison cached flow parameters belonging to any tenant, potentially leading to credential compromise or unauthorized access within the platform. The vulnerability has a CVSS 3.1 score of 10.0, indicating critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality and integrity.

The vulnerability allows an unauthenticated remote attacker to bypass authorization controls and write arbitrary data into the shared Redis cache for any tenant. This compromises the platform's credential-encryption boundary and enables poisoning of cached flow parameters, which could lead to unauthorized access or credential compromise across tenants. The impact on confidentiality and integrity is high, while availability is not affected.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the Redis service and monitor for unauthorized access attempts if possible.