CVE-2026-81552 is a high severity (CVSS 8.8) command execution flaw in IBM DataStage on Cloud Pak for Data 5.4.0.0 caused by improper neutralization of environment variables. A remote authenticated attacker could execute arbitrary commands. IBM says to upgrade to 5.4 patch 7 or later.
What's affected
- IBM DataStage on Cloud Pak for Data 5.4.0.0.
- IBM says to upgrade DataStage on Cloud Pak for Data 5.4.0.0 to 5.4 patch 7 or later, following the instructions linked from the bulletin. IBM lists no workarounds.
- The record lists this as an OS command injection (CWE-78).
Record severity: CVSS 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The weakness class is CWE-78, OS Command Injection.
How to check if you're exposed
Read the DataStage version and patch level in the Cloud Pak for Data console and compare with 5.4 patch 7. Review who can define job parameters and environment settings, because the flaw concerns environment variables.
What to do now
- Check the patch level of each DataStage instance.
- Upgrade to 5.4 patch 7 or later.
- Limit who may set environment variables for jobs.
- Review recent job definitions that set unusual variables.
- Verify the upgrade and record it.
Why it matters
Environment variables are inputs too. When a program passes them into a shell or a child process without cleaning them, an attacker who controls a value can change what runs, which falls under OS command injection (CWE-78).
In data platforms, job authors often set variables as part of normal work. That makes access control on who can define jobs the practical safeguard until the patch is installed. The record does not mark the CVE as exploited in the wild. After upgrading, review service account permissions for the DataStage pods and the network policies around them, because a command that runs inside a pod inherits everything that pod can reach.
Quick check
Is this the same as CVE-2026-81545?
No. Both are command execution flaws in the same bulletin but described differently; the same patch fixes both.
Is a login needed?
Yes, a remote authenticated attacker per the record.
Sources
To see where this and other CVEs sit in your own dependencies, try the free in-browser scan at gold.safeguard.sh/scan.
Last reviewed: 18 October 2026.
