Talend vulnerabilities
Published CVEs affecting Talend products: 3 record(s), with severity, exploitation and fixes.
CVE-2026-9057
High · 8.2
May 20, 2026
Security fix for Qlik Talend Administration Center URL access control vulnerability
A broken access control issue has been identified in the Talend Administration Center, that allows a user with “View” permission to modify the Talend Studio update URL. This issue was resolved in a patch, which is already available.
CVE-2026-9056
Medium · 5.4
May 20, 2026
Security fix for Qlik Talend Administration Center cross-site scripting vulnerability
A stored cross-site scripting vulnerability has been found in the Talend Administration Center. An attacker with permission to manage servers can store a XSS payload that can be triggered by a different user.
CVE-2026-6264
Critical · 9.8
Apr 14, 2026
Talend JobServer and Runtime JMX Monitoring Port Unauthenticated Remote Code Execution
A critical vulnerability in the Talend JobServer and Talend Runtime allows unauthenticated remote code execution via the JMX monitoring port. The attack vector is the JMX monitoring port of the Talend JobServer. The vulnerability can be mitigated for the Talend JobServer by requiring TLS client authentication for the monitoring port; however, the patch must be applied for full mitigation. For Talend ESB Runtime, the vulnerability can be mitigated by disabling the JobServer JMX monitoring port, which is disabled by default from the R2024-07-RT patch.