IBM DataStage and WebSphere Liberty: CVE-2026-82110, 82101 and 93895, Three Critical Flaws in Two Days

Within two days, NVD published three critical IBM CVEs: two path traversals in DataStage on Cloud Pak for Data 5.4.0.0 on October 12, 2026, and a gRPC access-control bypass in WebSphere Application Server Liberty on October 13.

The common thread: both are pieces of application infrastructure that often go missing from inventories — a data integration platform and a Java runtime embedded in dozens of applications.

None is in the CISA KEV catalog as of writing.

IBM DataStage on Cloud Pak for Data: CVE-2026-82110 and CVE-2026-82101

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path traversal.

Two CVEs, one root cause: a path traversal reachable by an authenticated user. CVE-2026-82110 leads to code execution, CVE-2026-82101 to denial of service.

Why it matters

PR:L means any DataStage account will do — no admin rights needed. On a data platform, accounts are plentiful: ETL developers, analysts, service accounts.

S:C says the impact reaches beyond the vulnerable component. On Cloud Pak for Data, DataStage sits among other platform services and holds the connections to the source and target databases of its flows. Running code there puts an attacker close to those connection credentials.

Versions

NVD cites 5.4.0.0 (CPE bound: 5.4.0). NVD gives no fixed version: check the IBM security bulletin for the fix or level to install.

Mitigation

1. Apply the IBM fix listed in the bulletin for DataStage 5.4.0.0.
2. Review accounts with DataStage access: remove inactive ones, reduce privileges.
3. Restrict network access to the platform interface to the users who need it.
4. Monitor for files created or modified outside expected project directories and unusual processes in DataStage pods.

IBM WebSphere Application Server Liberty: CVE-2026-93895

IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.

Liberty lets you protect gRPC service methods with declarative access controls. This flaw lets an unauthenticated attacker bypass them: methods you thought were restricted to certain roles become callable.

Why it matters

The vector is PR:N with high confidentiality and integrity impact. Real-world severity depends on what your gRPC methods do: if they expose data or write operations guarded only by those controls, all of it is reachable.

The caveat: only applications exposing gRPC services on Liberty fit this scenario. But Liberty is often embedded in third-party products and container images — you may not know everywhere it runs.

Versions

The NVD description gives the range 20.0.0.12 through 26.0.0.10. NVD publishes no fixed version: check the IBM bulletin for the fix pack or iFix to apply.

Mitigation

1. Apply the IBM fix pack or iFix listed in the bulletin.
2. Inventory Liberty instances exposing the gRPC feature, including in container images and products that embed Liberty.
3. Don't rely on Liberty's controls alone for sensitive methods in the meantime: filter network access to gRPC ports, add authorization checks in application code.
4. Monitor application logs for gRPC calls to protected methods with no matching authentication.

Shared Detection

• An accurate inventory of DataStage and Liberty versions — embedded Liberty included
• Application access logs: sensitive functions called from unusual accounts or sources
• Modified files and unexpected child processes on affected nodes

Why Monitor Your Runtimes and Data Platforms

A runtime like Liberty or a platform like Cloud Pak for Data doesn't always show up in an inventory under its own name: it hides inside an application, an image, a third-party product. Yet that's what these CVEs target.

With cveo.tech, inventory your middleware components with exact versions, and get alerted whenever a critical CVE affects them.