CVE-2026-107331: Absolute Path Traversal in IBM DataStage
CVE-2026-107331 affects IBM DataStage on Cloud Pak for Data 5.4.0.0. According to the NVD entry published 2026-11-08, a remote authenticated attacker could obtain sensitive information because of an absolute-path traversal vulnerability. The record is scored CVSS 9.9.
Absolute-path traversal flaws occur when an application accepts a full filesystem path from the user without restricting it to an intended directory, which can let an attacker read files the service account can access, such as configuration files and credentials. The NVD text does not say which files are reachable, so the real-world impact depends on the deployment.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-107331 |
| CVSS Score | 9.9 (Critical) |
| Weakness | Absolute path traversal |
| Affected Product | IBM DataStage on Cloud Pak for Data |
| Affected Version | 5.4.0.0 |
| Privileges Required | Authenticated user |
| Impact | Disclosure of sensitive information |
| Published | 2026-11-08 |
| Source | NIST NVD |
No in-the-wild exploitation has been reported, and the NVD entry does not list a fix level. Consult IBM's security bulletin.
Remediation
- Identify Cloud Pak for Data clusters running DataStage 5.4.0.0.
- Apply the IBM fix or interim fix referenced in the vendor bulletin as soon as it is available.
- Reduce the authenticated user base with access to DataStage to those who need it, and review roles.
- Rotate secrets that may be readable from the service's filesystem (connection credentials, API keys) if suspicious access is found.
- Review logs for requests containing absolute paths such as
/etc/or/var/in file-related parameters.
Key Takeaways
- CVE-2026-107331 is a CVSS 9.9 path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0.
- Exploitation requires authentication, so tighten access and monitor accounts.
- Patch per IBM guidance and rotate any exposed secrets.