CVE-2026-9057: Talend Administration Center Auth Bypass

CVE-2026-9057 Overview

CVE-2026-9057 is a broken access control vulnerability affecting the Qlik Talend Administration Center (TAC). The flaw allows a user holding only the View permission to modify the Talend Studio update URL. By altering the update endpoint, an authenticated low-privileged user can redirect Talend Studio clients to attacker-controlled infrastructure during the update process. This creates a path for supply chain style compromise of downstream Studio installations. Qlik has issued a patch addressing the access control gap.

Critical Impact

A user with read-only View permission can change the Talend Studio update URL, enabling redirection of update traffic to malicious servers and downstream code delivery to Studio clients.

Affected Products

• Qlik Talend Administration Center (TAC)
• Talend Studio (impacted via altered update URL)
• Qlik Talend Data Integration deployments using TAC for update distribution

Discovery Timeline

• 2026-05-20 - CVE-2026-9057 published to the National Vulnerability Database
• 2026-05-20 - Last updated in NVD database
• 2026-05-20 - Qlik published the Security fix for Qlik Talend Administration Center URL access

Technical Details for CVE-2026-9057

Vulnerability Analysis

The vulnerability is a Broken Access Control issue in the Talend Administration Center web application. The View role in TAC is intended to grant read-only access to administrative resources. However, the server-side authorization check for the Talend Studio update URL configuration endpoint does not validate that the caller holds a write-level role. As a result, the endpoint accepts modification requests from any authenticated user with the View permission. Because TAC distributes update metadata to Talend Studio clients, an attacker who alters the update URL can serve malicious update payloads. This converts a low-privilege account into a foothold for compromising Studio installations across the environment.

Root Cause

The root cause is missing or insufficient server-side authorization enforcement on the configuration endpoint controlling the Studio update URL. The application relies on UI-layer controls or trusts client-supplied role context rather than enforcing role-based access control on the backend handler. Any session with the View permission can submit a configuration change that the server accepts and persists.

Attack Vector

The attack is network-based and requires an authenticated TAC account with the View role. The attacker issues an HTTP request to the update URL configuration endpoint and substitutes a controlled hostname. Talend Studio clients configured against the affected TAC then retrieve update metadata and binaries from the attacker-controlled host. The scope is changed because compromise of the update channel affects systems beyond TAC itself, including Talend Studio endpoints. No user interaction is required on the victim Studio clients.

No verified public exploit code is available. See the Qlik Security Fix Article for vendor-supplied technical details.

Detection Methods for CVE-2026-9057

Indicators of Compromise

• Unexpected changes to the Talend Studio update URL configuration in TAC audit logs.
• Talend Studio update requests resolving to domains outside of the approved Qlik or internal update infrastructure.
• Outbound HTTP/HTTPS traffic from Talend Studio hosts to previously unseen update endpoints.
• TAC configuration change events initiated by accounts holding only the View role.

Detection Strategies

• Review TAC audit logs for configuration modifications submitted by users whose assigned role is View.
• Compare the currently configured Studio update URL against the documented Qlik update endpoint and flag deviations.
• Inspect web server access logs on TAC for POST or PUT requests targeting update URL configuration paths from low-privileged sessions.
• Correlate Studio client update activity with TAC configuration timestamps to identify suspicious update redirection windows.

Monitoring Recommendations

• Enable verbose audit logging on TAC for all administrative configuration endpoints and forward logs to a centralized SIEM.
• Alert on any change to the Studio update URL regardless of the user role performing the change.
• Monitor Talend Studio host network egress for connections to non-approved update domains.
• Track creation and permission changes for TAC accounts to identify low-privilege accounts that could be abused.

How to Mitigate CVE-2026-9057

Immediate Actions Required

• Apply the Qlik-provided patch referenced in the Security fix for Qlik Talend Administration Center URL access advisory.
• Verify the currently configured Talend Studio update URL matches the expected vendor or internal value and restore it if altered.
• Audit all TAC user accounts and remove unnecessary View or higher privileges from non-administrative users.
• Rotate credentials for any TAC account that may have been used to modify the update URL.

Patch Information

Qlik has released a patch addressing the broken access control issue in the Talend Administration Center. The fix enforces proper role validation on the update URL configuration endpoint so that only users with write-level administrative permissions can modify the value. Refer to the Qlik support article for version-specific patch identifiers and upgrade instructions.

Workarounds

• Restrict network access to the TAC administrative interface to trusted management subnets only.
• Temporarily reduce the number of accounts assigned the View role until the patch is applied.
• Implement egress filtering on Talend Studio hosts to restrict update traffic to known-good update domains.
• Manually monitor and validate the configured Studio update URL on a recurring schedule until patching is complete.

# Configuration example: verify Studio update URL via TAC API and restrict egress
# Replace <tac-host>, <token>, and <approved-update-host> with environment values

curl -s -H "Authorization: Bearer <token>" \
  https://<tac-host>/org.talend.administrator/metaServlet?action=getConfig \
  | jq '.studioUpdateUrl'

# Example egress allowlist (iptables) on Talend Studio hosts
iptables -A OUTPUT -p tcp -d <approved-update-host> --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -m string --string "update" --algo bm -j LOG --log-prefix "TAC-UPDATE-EGRESS: "
iptables -A OUTPUT -p tcp --dport 443 -j DROP