IBM DataStage and Cloud Pak for Data: Arbitrary Redis cache write (CVE-2026-81212)

IBM DataStage, when deployed on Cloud Pak for Data version 5.4.0.0, is susceptible to an unauthenticated arbitrary write vulnerability. This flaw resides in the handling of the platform's shared Redis cache mechanism. An external, unauthenticated actor can write data to the Redis instance under any tenant's key. This effectively collapses the logical isolation between multi-tenant environments, enabling the poisoning of cached flow parameters.

The impact of this vulnerability is severe, as it allows attackers to manipulate cached configuration and authentication artifacts, potentially leading to unauthorized access, privilege escalation, or full credential theft across the multi-tenant architecture. Because the vulnerability allows writing to shared infrastructure, the scope extends to any tenant residing on the affected platform instance. Organizations utilizing this specific version are at high risk of environment compromise through the exploitation of this cache-poisoning primitive.

Impact

The vulnerability carries a CVSS 3.1 base score of 10.0. Successful exploitation allows for complete bypass of credential encryption boundaries within a multi-tenant environment. This can lead to unauthorized access to tenant-specific data, data exfiltration, or total compromise of individual tenant workflows within the Cloud Pak for Data ecosystem.

Recommendation

• Verify your current Cloud Pak for Data version and immediately apply security patches provided by IBM to remediate CVE-2026-81212.
• Audit Redis access logs for unexpected external write operations or cross-tenant key access patterns.
• Implement strict network segmentation or firewall rules limiting access to the Redis instance to authorized application components only.
• If immediate patching is not possible, restrict access to the DataStage management interfaces via an internal-only gateway or VPN to mitigate unauthenticated access vectors.