Talend Administration Center EUVD-2026-31061

Exploitation requires an authenticated session on the Talend Administration Center with at least the 'View' permission role assigned to the attacker's account, plus network reachability to the TAC web interface. The CVSS AC:H rating implies additional non-trivial conditions are required to successfully alter the update URL (likely specific request crafting or timing not detailed in the public description), and impact only materializes once downstream Talend Studio clients perform an update check against the modified URL - so deployments with no Studio clients or with update checks disabled are not realistically exploitable. The flaw does not require user interaction (UI:N) once the attacker reaches the configuration endpoint.

Risk is meaningful but not maximal. The CVSS vector AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N indicates a remote but high-complexity attack that still requires an authenticated user with at least 'View' permission - a low bar inside an organization but it excludes pure external attackers. The Changed scope and high C/I impact (8.2) correctly reflect the downstream blast radius: poisoning the Studio update URL can pivot from a single low-privileged TAC account into supply-chain-style compromise of every Studio client that fetches updates. EPSS data is not provided, KEV does not list this CVE, and no public PoC is referenced, so prioritization should rest on internal exposure: organizations with broad TAC user populations and many Studio clients should treat this as high priority; isolated single-developer deployments are lower priority. The AC:H rating suggests non-trivial conditions to weaponize, but the description does not detail them - verify with the vendor advisory before deprioritizing.

An insider or attacker who has phished a low-privileged TAC user with 'View' role authenticates to the Administration Center web UI, locates the Studio update URL setting, and changes it to an attacker-controlled host serving a malicious Studio update payload. When developers' Talend Studio clients next check for updates, they pull and install the malicious package, giving the attacker code execution on developer workstations with access to ETL credentials and data pipelines.