Threats affecting pkg:maven/com.ibm/datastage-on-cloud-pak-for-data

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary code due to improper configuration of the XSLT transformation engine.

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special characters in the PxPeek name property.

CVE-2026-81207 is a Server-Side Request Forgery (SSRF) vulnerability in IBM DataStage on Cloud Pak for Data version 5.4.0.0. An authenticated tenant without project membership or role can fully control the scheme, host, port, and path of an outbound fetch request from a shared-infrastructure pod. The vulnerability allows reflection of the WSDL body verbatim to the caller. The affected component runs on an OpenShift overlay with access to co-tenant services, in-cluster CP4D APIs, and link-local addresses. The vulnerability impacts confidentiality with high severity and integrity with low severity, with no impact on availability.

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to a Server-Side Request Forgery (SSRF) vulnerability.

CVE-2026-82098 is a high-severity vulnerability in IBM DataStage on Cloud Pak for Data version 5.4.0.0. It involves improper neutralization of special elements used in OS commands, allowing a remote authenticated attacker to execute arbitrary commands on the affected system. This vulnerability has a CVSS score of 8.8, indicating a significant risk to confidentiality, integrity, and availability. No patch or vendor advisory is currently provided, and there are no known exploits in the wild.