Man-in-the-Middle Vulnerability in IBM DataStage on Cloud Pak for Data

CVE-2026-84418

What is CVE-2026-84418?

IBM DataStage on Cloud Pak for Data 5.4.0.0 is susceptible to a man-in-the-middle vulnerability, allowing attackers to present a falsified TLS certificate. This enables unauthorized interception of connections, leading to the potential capture of the IAM bearer Authorization header linked to the user's session. By obtaining this token, an attacker could gain expansive platform-scope tenant API access, which permits them to read, manipulate, and control DataStage projects, flows, assets, and pipeline definitions. Exploitation necessitates an external network interceptor, as the SDK code operates client-side on the user's machine.

References