Executive brief
DTStack Taier, a big data development and scheduling platform, contains a security vulnerability that allows unauthorized users to bypass login requirements. By exploiting this flaw, an attacker could potentially execute malicious code on the server by manipulating database connection settings. This could lead to a complete system takeover, unauthorized data access, or disruption of data processing operations.
Technical details
An authentication bypass vulnerability exists in the 'preHandle' function of 'LoginInterceptor.java' within DTStack Taier versions up to 1.4.0. The flaw resides in the Source Connection Test Endpoint, where improper validation allows remote, unauthenticated attackers to bypass security checks. When combined with a JDBC URL injection vulnerability, this allows an attacker to perform Pre-Auth Remote Code Execution (RCE). The issue is tracked as CWE-287 (Improper Authentication). A patch has been released in commit f95389e7f74acec42bcee079a616aaa06f9551d2 to address the logic error in the interceptor.
Affected products
- DTStack Taier Up to 1.4.0
Timeline
- 2026-06-09: advisory: NVD publication date
- 2026-06-08: disclosed: Vulnerability reported via VulDB
- 2026-06-08: patched: Patch commit f95389e7f74acec42bcee079a616aaa06f9551d2 identified