CVE-2026-81551 is a high severity (CVSS 8.8) path traversal flaw in IBM DataStage on Cloud Pak for Data 5.4.0.0. A remote authenticated attacker could write to or delete files on shared storage. IBM says to upgrade to 5.4 patch 5 or later, and lists no workarounds.
What's affected
- IBM DataStage on Cloud Pak for Data 5.4.0.0.
- IBM says to upgrade to 5.4 patch 5 or later, following the instructions in the bulletin. Note that other CVEs in this series need patch 7, so aim for the latest patch.
- IBM lists no workarounds.
Record severity: CVSS 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The weakness class is CWE-22, Path Traversal.
Source note: This CVE sits in a different IBM bulletin (patch 5) than the other DataStage entries in this series (patch 7). Applying patch 7 or later covers both.
How to check if you're exposed
Read the DataStage service version and patch level from the Cloud Pak for Data console and compare with 5.4 patch 5. Since the impact is on shared storage, also list which storage volumes DataStage can write to, and whether backups of those volumes exist.
What to do now
- Read the patch level of each DataStage instance.
- Upgrade to at least 5.4 patch 5, and preferably patch 7 or later.
- Confirm recent backups of shared storage used by DataStage.
- Restrict write access of the service account to the directories it needs.
- Review audit logs for file deletes you cannot explain.
Why it matters
Path traversal (CWE-22) means input that names a file is not confined to the folder it should stay in, so an attacker can reach other places. The impact here is writing or deleting files on shared storage, which affects integrity and availability for other users of that storage.
With storage shared across tenants or projects, one user acting beyond their folder is a real concern. The record does not mark the CVE as exploited in the wild.
Quick check
Why does this one say patch 5?
It is documented in a separate IBM bulletin. Patch 7 is later than patch 5, but confirm in IBM upgrade instructions that it includes this fix.
What can the attacker do?
Write to or delete files on shared storage, per the record.
Sources
To see where this and other CVEs sit in your own dependencies, try the free in-browser scan at gold.safeguard.sh/scan.
Last reviewed: 18 October 2026.
