CVE-2026-81212 — IBM DataStage 10.0. Unauthenticated write into shared Redis under any tenant’s key. Credential-encryption boundary collapses across the whole instance.

A:N/S:C/C:H/I:H. Nothing goes down. No crash, no alert. The platform just serves poisoned flow parameters to every tenant’s jobs.

No PoC, not in KEV.

Fix: Cloud Pak for Data 5.4 patch 8 — shipped the same day as the CVE. At least one tracker still says no patch. It’s wrong.

IBM documents no workaround. Restrict Redis reachability to the pods that need it until you patch.

Also in 5.4.0.0: CVE-2026-82107 (9.6), CVE-2026-42586 (9.1), CVE-2026-81207 (8.5). Patch the cluster.

https://threataft.com/articles/ibm-datastage-cve-2026-81212-redis-tenant-write

#infosec #CVE #IBMDataStage #Redis #vulnerability