https://vulnerability.circl.lu/sightings/feed 2026-10-20T05:35:34.810159+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/3df739e1-c8df-4127-8c24-4f24e4ef086b/export 2026-10-20T05:35:34.840083+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "3df739e1-c8df-4127-8c24-4f24e4ef086b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84418", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117430592625823146", "content": "CVE-2026-84418 DataStage on Cloud Pak for Data Improper Certificate Validation IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header automatically attached by the session adapter. The captured token grants full platform-scope tenant API access, enabling the attacker to read and manipulate the victim's DataStage projects, flows, assets, and pipeline definitions. This is client-side SDK code running on the user's own machine, so exploitation requires an external network interceptor rather than a co-tenant in the shared cluster.\nhttps://www.cve.org/CVERecord?id=CVE-2026-84418https://www.ibm.com/support/pages/node/7288649#ibm #IBM #DataStageonCloudPakforData#CVE_2026_84418#bot", "creation_timestamp": "2026-10-12T23:44:02.842186Z"} 2026-10-12T23:44:02.842186+00:00