CVE-2026-11618
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
DTStack Taier up to version 1.4.0 has a vulnerability in the preHandle function in LoginInterceptor.java related to the source connection test endpoint. Remote exploitation can bypass authentication. Exploit publicly disclosed.
Risk Assessment
An attacker can remotely bypass authentication and gain unauthorized access, potentially leading to data theft or manipulation.
Recommendation
Immediately apply the patch (commit f95389e7f74acec42bcee079a616aaa06f9551d2) or update to a fixed version.
Other vulnerabilities in DTStack Taier
See all- CVE-2026-19763Low
A vulnerability was determined in DTStack Taier version 1.4.0, affecting the FileUtils.deleteDirectory function in ClusterController.java. Manipulation of the clusterName argument causes path traversal. Remote exploitation is possible.
- CVE-2026-19762High
A vulnerability was found in DTStack Taier 1.4.0 in the function Paths.ge of the file FileChunkController.java in the Chunk-Check Endpoint component. Manipulation of the argument Name results in path traversal. The attack may be launched remotely, and the exploit has been made public.
- CVE-2026-19761Medium
A vulnerability was found in DTStack Taier version 1.4.0, affecting the MultipartFile.getOriginalFilename function in UploadController.java. Manipulation of the File argument leads to path traversal. The attack can be initiated remotely.
- CVE-2026-9437Medium
A vulnerability in DTStack Taier 1.4.0. The Runtime.exec function in the REST API component allows OS command injection via the sqlText argument. Remote attack, exploit public.
Original NVD description (English source)
A vulnerability was determined in DTStack Taier up to 1.4.0. The affected element is the function preHandle of the file taier-data-develop/src/main/java/com/dtstack/taier/develop/interceptor/LoginInterceptor.java of the component Source Connection Test Endpoint. Executing a manipulation can lead to improper authentication. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called f95389e7f74acec42bcee079a616aaa06f9551d2. A patch should be applied to remediate this issue.