CVE-2026-81212CWE-285

CVE-2026-81212

Critical · published October 21, 2026

CVSS v3.1
10.0
EPSS
0%
Percentile
17.9
In the wild
Unconfirmed
What it is

IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poison any tenant's cached flow parameters.

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00267 · 17.9th percentile
Weakness
CWE-285 · Improper Authorization
Published
2026-10-21T02:19Z
References (1)
https://www.ibm.com/support/pages/node/7289603 · [email protected]
EPSS history
Timeline
  • 22 OCT 03:35Z
    EPSS moved — → 0%
    epss
  • 20 OCT 21:58Z
    DataStage on Cloud Pak for Data Improper Authorization
    cvelistv5
  • 20 OCT 21:58Z
    DataStage on Cloud Pak for Data Improper Authorization
    cvelistv5