# CVE-2026-9057: Qlik Talend Administration Center broken access control in update URL

Source: https://junglewise.ai/threats/cve-2026-9057-qlik-talend-administration-center-broken-access-control-in-update  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-20. Updated: 2026-05-20  
License: CC BY 4.0 with a link back

CVE-2026-9057 · Severity: high · CVSS 8.2 · Published 2026-05-20

A security flaw in the Talend Administration Center allows users with limited 'View' permissions to change the update URL for Talend Studio. This could allow an attacker to redirect software updates to a malicious server, potentially leading to the installation of unauthorized or harmful software on developer workstations. Organizations using this platform should apply the available security patch to prevent unauthorized configuration changes.

Vendors: [Qlik](https://junglewise.ai/threats/vendors/qlik).

## Quick answers

**Is CVE-2026-9057 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9057 being exploited in the wild.

**How severe is CVE-2026-9057?** High severity, with a CVSS score of 8.2, published 20 May 2026.

**Which products and versions are affected?** Qlik Talend Administration Center All versions before Patch_20251121_QTAC-1471_R2025-11_v1-8.0.1.

**Is there a fix for CVE-2026-9057?** A patch was published on 2025-11-21: Patch QTAC-1471 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9057 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-9057?** Check whether you run Qlik Talend Administration Center at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A broken access control vulnerability exists in the Talend Administration Center (TAC) due to improper permission enforcement. An authenticated attacker with low-level 'View' privileges can bypass intended restrictions to modify the Talend Studio update URL configuration. By redirecting this URL to a server under their control, the attacker could facilitate the delivery of malicious updates to Talend Studio instances. The attack requires network access to the TAC interface and valid low-privileged credentials. A patch (QTAC-1471) has been released to address this issue by enforcing proper authorization checks.

## Affected products

- Qlik Talend Administration Center All versions before Patch_20251121_QTAC-1471_R2025-11_v1-8.0.1

## Timeline

- 2025-11-21: patched: Patch QTAC-1471 released
- 2026-05-20: disclosed: CVE-2026-9057 published

## References

- [https://community.qlik.com/t5/Official-Support-Articles/Security-fix-for-Qlik-Talend-Administration-Center-URL-access/ta-p/2548524](https://community.qlik.com/t5/Official-Support-Articles/Security-fix-for-Qlik-Talend-Administration-Center-URL-access/ta-p/2548524)

## Related threats

- [Qlik Talend Administration Center stored XSS in server management](https://junglewise.ai/threats/cve-2026-9056-qlik-talend-administration-center-stored-xss-in-server-management)