Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-107331 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-08 |
| Vendor | IBM |
| Product | DataStage on Cloud Pak for Data |
| CVSS Score | 9.9 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an absolute path traversal flaw (CWE-36). A remote, authenticated attacker can pass an absolute file path to the application and thereby access data outside the directory the application should restrict them to. IBM rated the vulnerability CVSS 9.9 (vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) — high confidentiality, integrity and availability impact combined with a scope change (S:C) mean the consequences can extend beyond the DataStage service itself.
DataStage is used to build ETL and data integration pipelines, so it usually has access to data source credentials, configuration files and business data. The flaw was disclosed in IBM’s consolidated bulletin “DataStage on Cloud Pak for Data has several vulnerabilities” (27 October 2026), alongside vulnerabilities in third-party libraries.
Required Actions
- Upgrade DataStage on Cloud Pak for Data to 5.4 patch 8 or later, following the instructions linked from the IBM bulletin.
- IBM lists no workarounds or mitigations. Until you upgrade, limit the number of accounts with DataStage access and restrict network access to the Cloud Pak for Data console.
- Review DataStage access logs for unusual requests containing absolute file paths.
- If exploitation is suspected, rotate the data source credentials stored in the DataStage configuration.
Who Is Affected?
The vulnerability affects organizations running IBM DataStage on Cloud Pak for Data version 5.4.0.0 by IBM — most often in banking, insurance, the public sector and large enterprises, where DataStage powers data warehouses and system integration. Classic IBM InfoSphere DataStage installations outside Cloud Pak for Data are not listed in the bulletin.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-107331 vulnerability?
It is an absolute path traversal flaw (CWE-36) in IBM DataStage on Cloud Pak for Data 5.4.0.0. A remote, authenticated attacker can supply an absolute path and reach files outside the directory intended by the application. IBM rated it CVSS 9.9 (critical).
Who is affected by CVE-2026-107331?
Organizations running the DataStage service in IBM Cloud Pak for Data 5.4.0.0 — most often for ETL and data integration in banking, insurance and large enterprises.
How to protect against CVE-2026-107331?
Upgrade DataStage on Cloud Pak for Data to 5.4 patch 8 or later following the instructions in the IBM bulletin. IBM lists no workarounds or mitigations.
