CVE-2021-42837

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-11-05 · updated 2026-06-17
Weakness: CWE-287

Description

An issue was discovered in Talend Data Catalog before 7.3-20210930. After setting up SAML/OAuth, authentication is not correctly enforced on the native login page. Any valid user from the SAML/OAuth provider can be used as the username with an arbitrary password, and login will succeed.

Affected products

Talend Data Catalog: before 7.3-20210930 — fixed in 7.3-20210930

How to fix

Upgrade to a fixed version: Talend Data Catalog 7.3-20210930. Check the vendor advisory for mitigations.

References

https://jira.talendforge.org/browse/TAPACHE-180
https://www.talend.com/resources/
https://jira.talendforge.org/browse/TAPACHE-180
https://www.talend.com/resources/

Get alerted when CVE-2021-42837 or the next vulnerability affects your stack