CVE-2026-11618: DTStack Taier Auth Bypass Vulnerability

CVE-2026-11618 Overview

CVE-2026-11618 is an authentication bypass vulnerability in DTStack Taier up to version 1.4.0. The flaw resides in the preHandle function of taier-data-develop/src/main/java/com/dtstack/taier/develop/interceptor/LoginInterceptor.java, specifically affecting the Source Connection Test Endpoint. An unauthenticated remote attacker can manipulate requests to bypass authentication controls. The exploit has been publicly disclosed, increasing the likelihood of opportunistic exploitation. The vulnerability is classified under [CWE-287] Improper Authentication. A patch identified by commit hash f95389e7f74acec42bcee079a616aaa06f9551d2 has been published in the upstream repository.

Critical Impact

Remote attackers can bypass authentication on the Source Connection Test Endpoint, enabling unauthorized access to data source connection functionality without valid credentials.

Affected Products

• DTStack Taier versions up to and including 1.4.0
• Component: Source Connection Test Endpoint
• File: taier-data-develop/src/main/java/com/dtstack/taier/develop/interceptor/LoginInterceptor.java

Discovery Timeline

• 2026-06-09 - CVE CVE-2026-11618 published to NVD
• 2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-11618

Vulnerability Analysis

The vulnerability stems from improper authentication enforcement in the LoginInterceptor.preHandle method. The interceptor is responsible for validating user sessions before requests reach protected handlers. Insufficient validation logic in this interceptor allowed requests targeting the Source Connection Test Endpoint to pass through without proper credential verification. Attackers can invoke data source connection testing functionality over the network without authenticating, exposing backend connection logic to unauthenticated users.

Root Cause

The root cause is missing token-based authentication enforcement inside LoginInterceptor. The class previously lacked a wired TokenService dependency, which is the component used to validate session tokens. Without the token check, the interceptor returned true for requests that should have been rejected, granting unauthenticated callers access to protected endpoints. The patch introduces a TokenService field injected via @Resource and uses it during preHandle to validate request credentials.

Attack Vector

The attack is performed remotely over the network with no authentication or user interaction required. An attacker sends crafted HTTP requests directly to the Source Connection Test Endpoint. Because the interceptor fails to enforce authentication, the request is processed by the downstream controller. Public disclosure of the issue, including the GitHub issue and VulDB submission, has increased the exposure of this flaw. EPSS data indicates a probability of 0.073% (percentile 22.27) as of 2026-06-11.

// Patch excerpt - LoginInterceptor.java
 import com.dtstack.taier.common.exception.TaierDefineException;
+import com.dtstack.taier.develop.service.user.TokenService;
 import com.dtstack.taier.develop.utils.CookieUtil;

+import javax.annotation.Resource;
 import javax.servlet.http.HttpServletRequest;

 public class LoginInterceptor extends HandlerInterceptorAdapter {

+    @Resource
+    private TokenService tokenService;
+
     @Override
     public boolean preHandle(HttpServletRequest request,
                              HttpServletResponse response,
                              Object handler) {
         String requestURI = request.getRequestURI();

Source: GitHub Commit f95389e

Detection Methods for CVE-2026-11618

Indicators of Compromise

• Unauthenticated HTTP requests reaching the Source Connection Test Endpoint of Taier without a valid session cookie or token header.
• Repeated requests to connection test URIs from unexpected source IPs, particularly external addresses.
• Application logs showing successful processing of data source connection tests with no preceding login event.

Detection Strategies

• Review web server and application logs for requests to the data source connection test paths that lack authentication tokens.
• Deploy web application firewall (WAF) rules to flag access to Taier interceptor-protected endpoints without authentication headers.
• Correlate access to source connection endpoints with prior authentication events to identify anomalies.

Monitoring Recommendations

• Enable verbose logging in LoginInterceptor to capture rejected and accepted request decisions.
• Monitor outbound connections initiated by Taier toward database backends for unexpected test connections.
• Alert on access patterns originating from non-internal IP ranges to Taier administrative interfaces.

How to Mitigate CVE-2026-11618

Immediate Actions Required

• Apply the upstream patch commit f95389e7f74acec42bcee079a616aaa06f9551d2 from the DTStack Taier repository.
• Restrict network access to Taier management endpoints using firewall or reverse proxy allowlists until patching is complete.
• Audit existing data source configurations for unauthorized modifications or test connections.

Patch Information

The upstream fix is published as commit f95389e7f74acec42bcee079a616aaa06f9551d2 in the DTStack Taier repository. The patch wires a TokenService dependency into LoginInterceptor to enforce authentication on previously bypassable paths. Additional details are available in GitHub Issue #1194 and the VulDB CVE-2026-11618 entry.

Workarounds

• Place Taier behind an authenticating reverse proxy that enforces session validation before requests reach the application.
• Block external access to the Source Connection Test Endpoint at the network perimeter.
• Disable or remove the Source Connection Test functionality if it is not required in your deployment.

# Example nginx rule to block unauthenticated access to the connection test endpoint
location ~* /api/.*connection.*test {
    if ($http_cookie !~* "token=") {
        return 401;
    }
    proxy_pass http://taier_backend;
}