EUVD-2026-35291
GHSA-287g-pjcr-xhgc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was determined in DTStack Taier up to 1.4.0. The affected element is the function preHandle of the file taier-data-develop/src/main/java/com/dtstack/taier/develop/interceptor/LoginInterceptor.java of the component Source Connection Test Endpoint. Executing a manipulation can lead to improper authentication. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called f95389e7f74acec42bcee079a616aaa06f9551d2. A patch should be applied to remediate this issue.
AnalysisAI
Unauthenticated remote access to the Source Connection Test endpoint in DTStack Taier up to 1.4.0 is possible because the preHandle method in LoginInterceptor.java does not invoke tokenService.decryption(token), allowing any network-reachable caller to bypass authentication entirely. The same patch commit reveals that ConnFactory.getSimpleConn() also lacked JDBC URL sanitization, meaning an unauthenticated attacker could supply dangerous parameters such as autoDeserialize or allowLoadLocalInfile to a malicious MySQL-compatible server, elevating the real-world impact well above the assigned CVSS 5.5 Medium rating. Publicly available exploit code exists (CVSS E:P confirmed); no CISA KEV listing is confirmed at time of analysis.
Technical ContextAI
DTStack Taier is an open-source distributed task scheduling and data development platform built on Spring MVC in Java. The affected class, LoginInterceptor, extends Spring's HandlerInterceptorAdapter and is responsible for enforcing authentication on inbound HTTP requests via its preHandle method. The root cause (CWE-287, Improper Authentication) is the absence of a tokenService.decryption(token) call within preHandle for requests reaching the Source Connection Test endpoint - the token is present in the request but its cryptographic integrity is never verified, so any value (or no value) passes the check. Compounding this, ConnFactory.getSimpleConn() in the taier-datasource-plugin-rdbms module accepted arbitrary JDBC connection URLs without filtering. The same fix commit adds a blocklist of known-dangerous MySQL connector parameters - autoDeserialize, allowLoadLocalInfile, allowUrlInLocalInfile, queryInterceptors, socketFactory, socketFactoryArg - precisely the parameters used in well-documented JDBC deserialization and local file read attacks. The fix commit also bumps the PostgreSQL JDBC driver from 42.2.2 to 42.2.25, addressing historically known vulnerabilities in that dependency. No formal CPE string has been published by NVD; the affected artifact is the com.dtstack:taier project through version 1.4.0, hosted at github.com/DTStack/Taier.
RemediationAI
Apply upstream fix commit f95389e7f74acec42bcee079a616aaa06f9551d2 from the DTStack Taier repository (github.com/DTStack/Taier/commit/f95389e7f74acec42bcee079a616aaa06f9551d2). A formally versioned patched release has not been confirmed from available data - organizations building from source should cherry-pick this commit and rebuild. As an immediate compensating control, restrict network access to the Source Connection Test HTTP endpoint at the reverse proxy, API gateway, or firewall layer so only authenticated internal users on trusted segments can reach it; this mitigates the authentication bypass externally but does not fix the underlying CWE-287. If the endpoint cannot be restricted, temporarily disable the datasource connection testing feature entirely and communicate the outage to data engineering teams - the trade-off is loss of a convenience feature versus unauthenticated RCE risk. Additionally, deploy logging or WAF rules to detect JDBC URLs containing autoDeserialize, allowLoadLocalInfile, queryInterceptors, or socketFactory as indicators of active exploitation attempts. Track the GitHub issue at github.com/DTStack/Taier/issues/1194 for vendor release announcements.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today