CVE-2026-81549 is a critical (CVSS 9.6) server side request forgery flaw in IBM DataStage on Cloud Pak for Data 5.4.0.0. Improper validation of the X-Forwarded-Proto header lets a remote authenticated attacker obtain sensitive information. IBM says to upgrade to 5.4 patch 7 or later.
What's affected
- IBM DataStage on Cloud Pak for Data 5.4.0.0.
- IBM says to upgrade DataStage on Cloud Pak for Data 5.4.0.0 to 5.4 patch 7 or later, following the instructions linked from the bulletin. IBM lists no workarounds.
- IBM scores this entry at 9.6 with changed scope, matching the record.
Record severity: CVSS 9.6 (critical), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. The weakness class is CWE-918, Server-Side Request Forgery.
How to check if you're exposed
Read the DataStage service version and patch level in the Cloud Pak for Data console, and compare with 5.4 patch 7. Also check which proxies and ingress layers sit in front of the service and which headers they pass through, since the issue involves a forwarding header.
What to do now
- Read the patch level of each DataStage instance.
- Upgrade to 5.4 patch 7 or later using IBM instructions.
- Make sure your ingress or proxy sets forwarding headers itself instead of passing client values through.
- Review who holds authenticated access.
- Check logs for requests with unusual forwarding headers.
Why it matters
Server side request forgery (CWE-918) means an attacker gets a server to make a request on their behalf. Here, the bulletin ties it to improper validation of the X-Forwarded-Proto header, which proxies use to tell a service whether the original request used HTTP or HTTPS. Services that trust a client supplied value can be steered.
The critical score comes from the changed scope and high confidentiality impact, since the server can reach internal resources the attacker cannot. The record does not mark this CVE as exploited in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why is a header involved?
The bulletin says the flaw is improper validation of the X-Forwarded-Proto header.
Does it need a login?
Yes, the record says a remote authenticated attacker.
Sources
To see where this and other CVEs sit in your own dependencies, try the free in-browser scan at gold.safeguard.sh/scan.
Last reviewed: 18 October 2026.
