SecNews@SecNews_GR
IBM DataStage: Υψηλή ευπάθεια εκθέτει διακριτικό IAM https://www.secnews.gr/739895/ibm-datastage-cve-2026-84418/?fsp_sid=18453
00000111
7.0K followersView on X
CVE-2026-84418
LOWCVSS 7.4 · HIGHSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header automatically attached by the session adapter. The captured token grants full platform-scope tenant API access, enabling the attacker to read and manipulate the victim's DataStage projects, flows, assets, and pipeline definitions. This is client-side SDK code running on the user's own machine, so exploitation requires an external network interceptor rather than a co-tenant in the shared cluster.
0.0/ 10 priority
Sources & remediation
Other references
Weakness type (CWE)
CWE-295
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day