Talend Administration Center CVE-2026-9056

The attacker must hold an active, authenticated account within the Talend Administration Center instance with the 'manage servers' permission explicitly granted (PR:L per CVSS vector - low-privilege authenticated access is required, not unauthenticated). Exploitation further requires that a second, distinct user (victim) must interact with the TAC web interface page where the payload is rendered (UI:R per CVSS vector - victim browsing action is mandatory). The TAC instance must be network-reachable to the attacker (AV:N), but no special network positioning such as man-in-the-middle is required beyond standard authenticated web access. Exploitation is limited by the requirement that the attacker already possesses a privileged internal role; anonymous or externally-sourced exploitation is not possible under this vulnerability's conditions.

The CVSS 5.4 Medium score reflects two significant limiting factors: authenticated access with low privileges (PR:L) and mandatory victim interaction (UI:R). These reduce real-world exploitability compared to unauthenticated, no-interaction vulnerabilities. The Changed scope elevates the base score beyond what the Low confidentiality and integrity impacts would otherwise yield, indicating cross-boundary browser impact. EPSS data was not provided in the available intelligence, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit code, indicating no confirmed or widespread active exploitation at time of analysis. The attack surface is constrained to users already holding server management roles within TAC - typically a small, privileged internal population or service accounts. However, the stored nature of the XSS is noteworthy: a single planted payload can silently affect multiple higher-privileged victims (e.g., administrators) without further attacker interaction, potentially enabling privilege escalation within the TAC platform via session token theft. This is a genuine medium-priority issue for organizations running TAC with multiple role-differentiated users, not merely a high-CVSS-but-low-real-risk finding.

An attacker with a TAC account holding server management privileges navigates to the server configuration interface and saves a malicious JavaScript payload - such as a script that exfiltrates the document.cookie to an external endpoint - embedded in a server name or description field. When a TAC administrator later browses the servers list or opens the configuration detail, the stored script silently executes in the administrator's browser, transmitting their session token to the attacker and enabling session hijacking without any further attacker interaction. No public exploit code is known, but stored XSS exploitation is a well-documented technique requiring minimal attacker skill.