Executive brief
D-Tale is an open-source data visualization and analysis tool. The login endpoint lacks rate limiting and account lockout mechanisms, allowing attackers to perform unlimited brute-force attempts to guess user credentials. This could lead to unauthorized access to D-Tale instances and the sensitive data they contain.
Technical details
The vulnerability is an improper restriction of excessive authentication attempts (CWE-307) in the Login function of dtale/auth.py. The login endpoint does not implement rate limiting, account lockout, or other anti-brute-force mechanisms. An unauthenticated attacker can make unlimited login attempts over the network to guess valid credentials. The attack is characterized as high complexity and difficult exploitability, likely requiring knowledge of valid usernames or accounts. Patches have not yet been released as the project maintainers have not responded to early notification.
Affected products
- Man Group D-Tale up to 3.22.0
Timeline
- 2026-08-15: disclosed
- other: Vulnerability reported to project early but maintainers have not responded