CVE-2026-6264
Description
A critical vulnerability in the Talend JobServer and Talend Runtime allows unauthenticated remote code execution via the JMX monitoring port. The attack vector is the JMX monitoring port of the Talend JobServer. The vulnerability can be mitigated for the Talend JobServer by requiring TLS client authentication for the monitoring port; however, the patch must be applied for full mitigation. For Talend ESB Runtime, the vulnerability can be mitigated by disabling the JobServer JMX monitoring port, which is disabled by default from the R2024-07-RT patch.
How to fix
- Talend Talend JobServerTPS-6017, TPS-6018 or later
- Talend Talend Runtime8.0.1.R2026-01-RT, 7.3.1-R2026-01 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Talend Talend JobServer | 8.0 ≤ v < TPS-6017, 7.3 ≤ v < TPS-6018 | TPS-6017, TPS-6018 |
| Talend Talend Runtime | 8.0 ≤ v < 8.0.1.R2026-01-RT, 7.3 ≤ v < 7.3.1-R2026-01 | 8.0.1.R2026-01-RT, 7.3.1-R2026-01 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.