https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 18:15:19 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-84418 <p>IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header automatically attached by the session adapter. The captured token grants full platform-scope tenant API access, enabling the attacker to read and manipulate the victim&#39;s DataStage projects, flows, assets, and pipeline definitions. This is client-side SDK code running on the user&#39;s own machine, so exploitation requires an external network interceptor rather than a co-tenant in the shared cluster.</p> <p>IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header automatically attached by the session adapter. The captured token grants full platform-scope tenant API access, enabling the attacker to read and manipulate the victim&#39;s DataStage projects, flows, assets, and pipeline definitions. This is client-side SDK code running on the user&#39;s own machine, so exploitation requires an external network interceptor rather than a co-tenant in the shared cluster.</p> https://db.gcve.eu/vuln/fkie_cve-2026-84418 https://db.gcve.eu/vuln/ghsa-528j-3v52-48qw <p>IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header automatically attached by the session adapter. The captured token grants full platform-scope tenant API access, enabling the attacker to read and manipulate the victim&#39;s DataStage projects, flows, assets, and pipeline definitions. This is client-side SDK code running on the user&#39;s own machine, so exploitation requires an external network interceptor rather than a co-tenant in the shared cluster.</p> <p>IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header automatically attached by the session adapter. The captured token grants full platform-scope tenant API access, enabling the attacker to read and manipulate the victim&#39;s DataStage projects, flows, assets, and pipeline definitions. This is client-side SDK code running on the user&#39;s own machine, so exploitation requires an external network interceptor rather than a co-tenant in the shared cluster.</p> https://db.gcve.eu/vuln/ghsa-528j-3v52-48qw