CVE-2026-81545 is a high severity (CVSS 8.8) OS command injection flaw in IBM DataStage on Cloud Pak for Data 5.4.0.0. A remote authenticated attacker could execute arbitrary commands. IBM says to upgrade to 5.4 patch 7 or later, and lists no workarounds.
What's affected
- IBM DataStage on Cloud Pak for Data 5.4.0.0.
- IBM says to upgrade DataStage on Cloud Pak for Data 5.4.0.0 to 5.4 patch 7 or later, following the instructions linked from the bulletin. IBM lists no workarounds.
- This is separate from CVE-2026-81539 and CVE-2026-81552, which are in the same bulletin.
Record severity: CVSS 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The weakness class is CWE-78, OS Command Injection.
How to check if you're exposed
Open the Cloud Pak for Data console, view the DataStage service, and read its version and patch level. An administrator with OpenShift access can also read the version from the service custom resource. Anything below 5.4 patch 7 needs the update.
What to do now
- Inventory DataStage instances and read patch levels.
- Upgrade to 5.4 patch 7 or later following the IBM instructions.
- Limit who can author or run jobs.
- Rotate any credentials stored in DataStage connections if you suspect misuse.
- Verify the patch level after the upgrade.
Why it matters
OS command injection (CWE-78) arises when text from a user ends up in a system command that is not escaped. The bulletin gives only a one line description for this CVE, so we describe the class and not the exact entry point.
Several similar command injection entries in the same bulletin show why one patch level matters more than any single CVE. The record does not mark it as exploited in the wild. Pair the upgrade with a review of cluster network policies and service account permissions, since a command running inside a DataStage pod inherits whatever that pod can reach. That review limits damage from this and any similar bug.
Quick check
How is this different from CVE-2026-81539?
Both are command injection with the same score, and the bulletin treats them as separate entries fixed in the same update.
What is the fixed level?
5.4 patch 7 or later.
Sources
To see where this and other CVEs sit in your own dependencies, try the free in-browser scan at gold.safeguard.sh/scan.
Last reviewed: 18 October 2026.
