CVE-2026-11618: DTStack Taier Authentication Bypass in Source Connection Test

Technical summary

The vulnerability exists in the LoginInterceptor.java file's preHandle function, which handles authentication logic for the Source Connection Test Endpoint. The improper authentication implementation (CWE-287) allows attackers to manipulate the authentication flow, effectively bypassing login controls. The flaw permits unauthenticated remote access to functionality that should require valid credentials. A patch has been identified (commit f95389e7f74acec42bcee079a616aaa06f9551d2) to address the root cause.

Business impact

Unauthorized access to Taier's data connection testing capabilities could allow attackers to enumerate configured data sources, test connections to backend databases, or pivot into connected systems. This exposes sensitive infrastructure details and data store configurations. For organizations using Taier in production data pipelines, this represents a direct path for credential harvesting and lateral movement into data warehouses or analytics systems.

Affected systems

DTStack Taier versions up to and including 1.4.0 are affected. The vulnerability specifically impacts instances with the Source Connection Test Endpoint accessible over the network. Verify your deployed version against the official DTStack release notes and determine network exposure of affected endpoints.

Exploitability

This vulnerability is highly exploitable. It requires no authentication, no user interaction, and can be triggered over the network with minimal complexity. Public disclosure increases the likelihood of active exploitation. The CVSS 3.1 score of 7.3 (HIGH) reflects the combination of network accessibility and the compromise of authentication controls, though impact is somewhat limited to confidentiality and integrity rather than availability.

Remediation

Apply the patch identified in commit f95389e7f74acec42bcee079a616aaa06f9551d2 to affected Taier installations. Review DTStack's official security advisories and release notes to confirm the exact patched version number and deployment procedures. Verify with your DTStack vendor contact for the corresponding release version that incorporates this commit.

Patch guidance

Obtain the patched version from DTStack's official repository or distribution channel that includes commit f95389e7f74acec42bcee079a616aaa06f9551d2. Before applying: (1) back up your Taier configuration and metadata database, (2) test the patch in a non-production environment that mirrors your data source configurations, (3) verify that data connection tests function correctly post-patch, and (4) plan a maintenance window for production deployment. Follow DTStack's upgrade documentation for any configuration migration steps.

Detection guidance

Monitor for unauthorized or suspicious requests to Source Connection Test Endpoints, particularly those originating from untrusted networks or lacking valid session tokens. Review authentication logs for failed login attempts followed by successful API calls without re-authentication. Look for patterns of rapid connection testing or enumeration of data sources by unauthenticated users. Implement network-level access controls restricting the Taier endpoint to trusted internal networks pending patching.

Why prioritize this

This vulnerability warrants immediate attention due to the combination of network accessibility, lack of authentication requirements, public disclosure, and direct exposure of sensitive data source infrastructure. Although not yet on the CISA KEV catalog, the public availability of exploit details and the ease of weaponization make this a priority for patching ahead of routine schedules.

Risk score, explained

The CVSS 3.1 score of 7.3 reflects a HIGH-severity issue driven by network accessibility (AV:N), low attack complexity (AC:L), and no privilege or user interaction requirements (PR:N/UI:N). The impact spans confidentiality, integrity, and availability of the affected endpoint (C:L/I:L/A:L), though not the entire system. The absence of scope change (S:U) limits the score; a broader scope would increase severity further.

Frequently asked questions