Vulnerability Details CVE-2026-84418
IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header automatically attached by the session adapter. The captured token grants full platform-scope tenant API access, enabling the attacker to read and manipulate the victim's DataStage projects, flows, assets, and pipeline definitions. This is client-side SDK code running on the user's own machine, so exploitation requires an external network interceptor rather than a co-tenant in the shared cluster.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 2.7%
CVSS Severity
CVSS v3 Score 7.4
Products affected by CVE-2026-84418
-
cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0