DTStack Taier EUVD-2026-58557

Exploitation requires an authenticated session with high-privilege cluster management rights in Taier, as confirmed by CVSS PR:H. The vulnerable code path is triggered specifically during the cluster creation workflow when the clusterName parameter is submitted to ClusterController.java and flows through ConsoleClusterService.addCluster() into the Kerberos path construction logic in ConsoleComponentService.getLocalKerberosPath(). Unauthenticated users and low-privilege users without cluster management access cannot reach the vulnerable code path. No non-default configuration is required beyond a standard Taier 1.4.0 deployment - the vulnerability exists in the default cluster creation flow. The key limiting factor is the PR:H requirement: compromise of an admin credential is a prerequisite, making this a post-authentication privilege-abuse scenario rather than an external network attack.

The CVSS 4.0 score of 5.1 with PR:H accurately characterises the constrained real-world risk. Exploitation requires an authenticated account with administrative cluster management privileges, which substantially reduces the realistic attack surface to malicious insiders or compromised admin credentials - not opportunistic external attackers. EPSS data was not provided in the input, so exploitation probability cannot be quantified. The vulnerability is absent from CISA KEV, and no public proof-of-concept code has been identified. Impact is limited to low integrity (arbitrary directory deletion outside temp scope) and low availability (potential disruption of Kerberos configuration directories), with no confidentiality impact confirmed by the CVSS vector. This is not an emergency-response priority but warrants remediation within a normal patch cycle. The wildcard in the CPE string (cpe:2.3:a:dtstack:taier:*:*:*:*:*:*:*:*) implies all pre-1.5.0 versions may be affected, though only 1.4.0 is explicitly named in the CVE description - a gap that should be clarified with the vendor.

An authenticated Taier administrator submits a cluster creation request with a crafted clusterName value such as '../../var/lib/taier-kerberos' to the Cluster Creation API endpoint. Taier's ConsoleComponentService builds an unsanitized path by concatenating the temp directory with the attacker-controlled name, then passes the result to FileUtils.deleteDirectory(), deleting an arbitrary directory on the server filesystem. No public exploit code has been identified, but the attack requires only a standard HTTP request with the necessary admin session token.