Is CVE-2026-11618 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11618 being exploited in the wild.

How severe is CVE-2026-11618?

High severity, with a CVSS score of 7.3, published 9 June 2026.

Is there a fix for CVE-2026-11618?

A patch was published on 2026-06-08: Patch commit f95389e7f74acec42bcee079a616aaa06f9551d2 identified Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-11618 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-11618?

Check whether you run DTStack Taier at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11618: DTStack Taier authentication bypass in LoginInterceptor

CVE-2026-11618 · Severity: high · CVSS 7.3 · Published 2026-06-09

DTStack Taier, a big data development and scheduling platform, contains a security vulnerability that allows unauthorized users to bypass login requirements. By exploiting this flaw, an attacker could potentially execute malicious code on the server by manipulating database connection settings. This could lead to a complete system takeover, unauthorized data access, or disruption of data processing operations.

Technologies: DTStack Taier. Vendors: DTStack.

Quick answers

Is CVE-2026-11618 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11618 being exploited in the wild.
How severe is CVE-2026-11618?: High severity, with a CVSS score of 7.3, published 9 June 2026.
Which products and versions are affected?: DTStack Taier Up to 1.4.0.
Is there a fix for CVE-2026-11618?: A patch was published on 2026-06-08: Patch commit f95389e7f74acec42bcee079a616aaa06f9551d2 identified Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-11618 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-11618?: Check whether you run DTStack Taier at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authentication bypass vulnerability exists in the 'preHandle' function of 'LoginInterceptor.java' within DTStack Taier versions up to 1.4.0. The flaw resides in the Source Connection Test Endpoint, where improper validation allows remote, unauthenticated attackers to bypass security checks. When combined with a JDBC URL injection vulnerability, this allows an attacker to perform Pre-Auth Remote Code Execution (RCE). The issue is tracked as CWE-287 (Improper Authentication). A patch has been released in commit f95389e7f74acec42bcee079a616aaa06f9551d2 to address the logic error in the interceptor.

Affected products

DTStack Taier Up to 1.4.0

Timeline

2026-06-09: advisory: NVD publication date
2026-06-08: disclosed: Vulnerability reported via VulDB
2026-06-08: patched: Patch commit f95389e7f74acec42bcee079a616aaa06f9551d2 identified

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.