Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for Talend JobServer by Talend

    CVE-2026-6264 (GCVE-0-2026-6264)

    Vulnerability from nvd – Published: 2026-04-14 01:49 – Updated: 2026-04-16 00:03
    VLAI
    Title
    Critical Security fix for the Talend JobServer and Talend Runtime
    Summary
    A critical vulnerability in the Talend JobServer and Talend Runtime allows unauthenticated remote code execution via the JMX monitoring port. The attack vector is the JMX monitoring port of the Talend JobServer. The vulnerability can be mitigated for the Talend JobServer by requiring TLS client authentication for the monitoring port; however, the patch must be applied for full mitigation. For Talend ESB Runtime, the vulnerability can be mitigated by disabling the JobServer JMX monitoring port, which is disabled by default from the R2024-07-RT patch.
    Severity
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: yes Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Talend Talend JobServer Affected: 8.0 , < TPS-6017 (custom)
    Affected: 7.3 , < TPS-6018 (custom)
    		Create a notification for this product.
    Talend Talend Runtime Affected: 8.0 , < 8.0.1.R2026-01-RT (custom)
    Affected: 7.3 , < 7.3.1-R2026-01 (custom)
    		Create a notification for this product.
    Credits
    Harpreet Singh (@TheCyb3rAlpha), Profession: Security Researcher
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6264",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-14T13:07:04.623162Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-14T13:14:17.018Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Talend JobServer",
          "vendor": "Talend",
          "versions": [
            {
              "lessThan": "TPS-6017",
              "status": "affected",
              "version": "8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "TPS-6018",
              "status": "affected",
              "version": "7.3",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Talend Runtime",
          "vendor": "Talend",
          "versions": [
            {
              "lessThan": "8.0.1.R2026-01-RT",
              "status": "affected",
              "version": "8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.3.1-R2026-01",
              "status": "affected",
              "version": "7.3",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:talend:jobserver:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "TPS-6017",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:talend:esb_runtime:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "8.0.1.R2026-01-RT",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Harpreet Singh (@TheCyb3rAlpha), Profession: Security Researcher"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A critical vulnerability in the Talend JobServer and Talend Runtime allows unauthenticated remote code execution via the JMX monitoring port. The attack vector is the JMX monitoring port of the Talend JobServer. The vulnerability can be mitigated for the Talend JobServer by requiring TLS client authentication for the monitoring port; however, the patch must be applied for full mitigation. For Talend ESB Runtime, the vulnerability can be mitigated by disabling the JobServer JMX monitoring port, which is disabled by default from the R2024-07-RT patch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-306 Missing Authentication for Critical Function",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-16T00:03:18.302Z",
        "orgId": "4ac701fe-44e9-4bcd-9585-dd6449257611",
        "shortName": "Bugcrowd"
      },
      "references": [
        {
          "url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fix-for-the-Qlik-Talend-JobServer-and-Talend/tac-p/2541974"
        }
      ],
      "title": "Critical Security fix for the Talend JobServer and Talend Runtime"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4ac701fe-44e9-4bcd-9585-dd6449257611",
    "assignerShortName": "Bugcrowd",
    "cveId": "CVE-2026-6264",
    "datePublished": "2026-04-14T01:49:08.920Z",
    "dateReserved": "2026-04-14T01:12:19.962Z",
    "dateUpdated": "2026-04-16T00:03:18.302Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-6264 (GCVE-0-2026-6264)

    Vulnerability from cvelistv5 – Published: 2026-04-14 01:49 – Updated: 2026-04-16 00:03
    VLAI
    Title
    Critical Security fix for the Talend JobServer and Talend Runtime
    Summary
    A critical vulnerability in the Talend JobServer and Talend Runtime allows unauthenticated remote code execution via the JMX monitoring port. The attack vector is the JMX monitoring port of the Talend JobServer. The vulnerability can be mitigated for the Talend JobServer by requiring TLS client authentication for the monitoring port; however, the patch must be applied for full mitigation. For Talend ESB Runtime, the vulnerability can be mitigated by disabling the JobServer JMX monitoring port, which is disabled by default from the R2024-07-RT patch.
    Severity
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: yes Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Talend Talend JobServer Affected: 8.0 , < TPS-6017 (custom)
    Affected: 7.3 , < TPS-6018 (custom)
    		Create a notification for this product.
    Talend Talend Runtime Affected: 8.0 , < 8.0.1.R2026-01-RT (custom)
    Affected: 7.3 , < 7.3.1-R2026-01 (custom)
    		Create a notification for this product.
    Credits
    Harpreet Singh (@TheCyb3rAlpha), Profession: Security Researcher
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6264",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-14T13:07:04.623162Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-14T13:14:17.018Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Talend JobServer",
          "vendor": "Talend",
          "versions": [
            {
              "lessThan": "TPS-6017",
              "status": "affected",
              "version": "8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "TPS-6018",
              "status": "affected",
              "version": "7.3",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Talend Runtime",
          "vendor": "Talend",
          "versions": [
            {
              "lessThan": "8.0.1.R2026-01-RT",
              "status": "affected",
              "version": "8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.3.1-R2026-01",
              "status": "affected",
              "version": "7.3",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:talend:jobserver:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "TPS-6017",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:talend:esb_runtime:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "8.0.1.R2026-01-RT",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Harpreet Singh (@TheCyb3rAlpha), Profession: Security Researcher"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A critical vulnerability in the Talend JobServer and Talend Runtime allows unauthenticated remote code execution via the JMX monitoring port. The attack vector is the JMX monitoring port of the Talend JobServer. The vulnerability can be mitigated for the Talend JobServer by requiring TLS client authentication for the monitoring port; however, the patch must be applied for full mitigation. For Talend ESB Runtime, the vulnerability can be mitigated by disabling the JobServer JMX monitoring port, which is disabled by default from the R2024-07-RT patch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-306 Missing Authentication for Critical Function",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-16T00:03:18.302Z",
        "orgId": "4ac701fe-44e9-4bcd-9585-dd6449257611",
        "shortName": "Bugcrowd"
      },
      "references": [
        {
          "url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fix-for-the-Qlik-Talend-JobServer-and-Talend/tac-p/2541974"
        }
      ],
      "title": "Critical Security fix for the Talend JobServer and Talend Runtime"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4ac701fe-44e9-4bcd-9585-dd6449257611",
    "assignerShortName": "Bugcrowd",
    "cveId": "CVE-2026-6264",
    "datePublished": "2026-04-14T01:49:08.920Z",
    "dateReserved": "2026-04-14T01:12:19.962Z",
    "dateUpdated": "2026-04-16T00:03:18.302Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}