CVE-2026-9056

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-9056", "assignerOrgId": "4ac701fe-44e9-4bcd-9585-dd6449257611", "state": "PUBLISHED", "assignerShortName": "Bugcrowd", "dateReserved": "2026-05-20T04:33:36.038Z", "datePublished": "2026-05-20T04:35:39.031Z", "dateUpdated": "2026-05-20T13:08:33.447Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4ac701fe-44e9-4bcd-9585-dd6449257611", "shortName": "Bugcrowd", "dateUpdated": "2026-05-20T04:35:39.031Z"}, "title": "Security fix for Qlik Talend Administration Center cross-site scripting vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-94: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "affected": [{"vendor": "Talend", "product": "Talend Administration Center", "versions": [{"version": "8.0", "status": "affected", "lessThan": "Patch_20260123_QTAC-1883 (cumulative patch)_R2026-01_v1-8.0.1", "versionType": "custom"}], "defaultStatus": "affected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:talend:administration_center:*:*:*:*:*:*:*:*", "versionEndExcluding": "Patch_20260123_QTAC-1883 (cumulative patch)_R2026-01_v1-8.0.1"}]}]}], "descriptions": [{"lang": "en", "value": "A stored cross-site scripting vulnerability has been found in the Talend Administration Center. An attacker with permission to manage servers can store a XSS payload that can be triggered by a different user."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "value": "Ahsan"}], "references": [{"url": "https://community.qlik.com/t5/Official-Support-Articles/Security-fix-for-Qlik-Talend-Administration-Center-cross-site/ta-p/2548522"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-20T13:08:26.585632Z", "id": "CVE-2026-9056", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-20T13:08:33.447Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-9056", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-20T13:08:26.585632Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-20T13:08:30.365Z"}}], "cna": {"title": "Security fix for Qlik Talend Administration Center cross-site scripting vulnerability", "credits": [{"lang": "en", "value": "Ahsan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "Talend", "product": "Talend Administration Center", "versions": [{"status": "affected", "version": "8.0", "lessThan": "Patch_20260123_QTAC-1883 (cumulative patch)_R2026-01_v1-8.0.1", "versionType": "custom"}], "defaultStatus": "affected"}], "references": [{"url": "https://community.qlik.com/t5/Official-Support-Articles/Security-fix-for-Qlik-Talend-Administration-Center-cross-site/ta-p/2548522"}], "descriptions": [{"lang": "en", "value": "A stored cross-site scripting vulnerability has been found in the Talend Administration Center. An attacker with permission to manage servers can store a XSS payload that can be triggered by a different user."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-94: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:talend:administration_center:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "Patch_20260123_QTAC-1883 (cumulative patch)_R2026-01_v1-8.0.1"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "4ac701fe-44e9-4bcd-9585-dd6449257611", "shortName": "Bugcrowd", "dateUpdated": "2026-05-20T04:35:39.031Z"}}}, "cveMetadata": {"cveId": "CVE-2026-9056", "state": "PUBLISHED", "dateUpdated": "2026-05-20T13:08:33.447Z", "dateReserved": "2026-05-20T04:33:36.038Z", "assignerOrgId": "4ac701fe-44e9-4bcd-9585-dd6449257611", "datePublished": "2026-05-20T04:35:39.031Z", "assignerShortName": "Bugcrowd"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "Talend Administration Center", "vendor": "Talend", "versions": [{"lessThan": "Patch_20260123_QTAC-1883 (cumulative patch)_R2026-01_v1-8.0.1", "status": "affected", "version": "8.0", "versionType": "custom"}]}], "source": "4ac701fe-44e9-4bcd-9585-dd6449257611"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A stored cross-site scripting vulnerability has been found in the Talend Administration Center. An attacker with permission to manage servers can store a XSS payload that can be triggered by a different user."}, {"lang": "es", "value": "Una vulnerabilidad de cross-site scripting almacenado ha sido encontrada en el Talend Administration Center. Un atacante con permiso para gestionar servidores puede almacenar una carga \u00fatil de XSS que puede ser activada por un usuario diferente."}], "id": "CVE-2026-9056", "lastModified": "2026-07-23T20:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "4ac701fe-44e9-4bcd-9585-dd6449257611", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9056", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-20T13:08:26.585632Z", "version": "2.0.3"}}]}, "published": "2026-05-20T05:16:23.350", "references": [{"source": "4ac701fe-44e9-4bcd-9585-dd6449257611", "url": "https://community.qlik.com/t5/Official-Support-Articles/Security-fix-for-Qlik-Talend-Administration-Center-cross-site/ta-p/2548522"}], "sourceIdentifier": "4ac701fe-44e9-4bcd-9585-dd6449257611", "vulnStatus": "Deferred"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[8.0,Patch_20260123_QTAC-1883 (cumulative patch)_R2026-01_v1-8.0.1)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Talend Administration Center", "source": "cna", "vendor": "Talend"}, "product": "administration_center", "vendor": "talend"}], "created": "2026-05-20T06:30:15.504510+00:00", "updated": "2026-05-20T06:30:15.743071+00:00", "vendors": ["talend", "talend$PRODUCT$administration_center"], "weaknesses": ["CWE-79"]}