CVE-2026-82101 is a critical (9.6) path traversal flaw in IBM DataStage on Cloud Pak for Data 5.4.0.0. A remote authenticated attacker could cause a denial of service. IBM's fix is to upgrade to 5.4 patch 7 or later, and the bulletin lists no workaround.
What's affected
IBM's bulletin 7288649 lists IBM DataStage on Cloud Pak for Data 5.4.0.0 as affected. IBM's remediation is to upgrade to 5.4 patch 7 or later, following the instructions linked in the bulletin. IBM lists no workarounds or mitigations.
The bulletin was published on 21 September 2026 and covers several CVEs, so read it for the rest of the set.
How to check if you're exposed
Check which DataStage on Cloud Pak for Data version and patch level your cluster runs. Your platform administrator can read this from the Cloud Pak for Data interface or its command line tooling.
The record requires an authenticated user, so also review who has DataStage accounts and what roles they hold. Fewer accounts means fewer people who could reach the flaw.
What to do now
- Confirm whether you run DataStage on Cloud Pak for Data 5.4.0.0.
- Upgrade to 5.4 patch 7 or later, using IBM's linked instructions.
- Review the list of users with DataStage access and remove accounts you no longer need.
- Check the bulletin for the other CVEs it fixes, since one upgrade addresses them together.
- Confirm the patch level once the upgrade is finished.
Why it matters
The weakness is CWE-22, improper limitation of a pathname to a restricted directory. A file path that should stay inside one folder can point outside it.
The score is high because the scope is changed and the vector lists high integrity and availability impact, even though the attacker must hold an account. IBM's text for this record mentions only denial of service. Its sibling, CVE-2026-82110, has the same class and score but the record says it can lead to code execution. Not listed in CISA's KEV catalog.
Cloud Pak for Data platforms combine many services, and DataStage is one tenant of a shared platform. A path traversal in one service can have effects beyond that service, which the changed scope in the vector reflects. In plain words, the damage can reach components other than the vulnerable one.
Account hygiene is the main lever you control before the upgrade. The record needs an authenticated user, so review who holds DataStage access, remove stale accounts, and check for shared credentials. Look at service accounts too, since they are often over privileged.
The upgrade itself is a patch level change to 5.4 patch 7 or later. Follow IBM's linked instructions, and plan a maintenance window, since platform patching on Cloud Pak for Data can involve restarts of several services. The bulletin lists other CVEs fixed by the same upgrade, so check the full list when you write your change record.
Quick check
Does the attacker need an account?
Yes. The record says remote authenticated attacker, and the vector lists low privileges.
Sources
Last reviewed: 19 October 2026.
