CVE-2026-111696: falha de alta gravidade em shaiwz data-platform-open
data-platform-open through commit efeacd3 Hardcoded AES Key for Datasource Passwords
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.3%
data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via cross-workspace IDOR, and decrypt them offline to recover plaintext database credentials.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
shaiwz · data-platform-openCVEs relacionadas — shaiwz data-platform-open
No mesmo produto, das mais perigosas para as menos.
Referências
https://github.com/shaiwz/data-platform-open/blob/efeacd35e8450b7a084fa2134d292cd058cf605b/data-platform-open-common/src/main/resources/application-common.yml#L104-L106https://github.com/shaiwz/data-platform-open/blob/efeacd35e8450b7a084fa2134d292cd058cf605b/data-platform-open-web/src/main/java/cn/dataplatform/open/web/service/impl/AesPasswordEncAndDecServiceImpl.java#L21-L25https://hackmd.io/@hieuPenguinnn/data-platform-open-datasource-cross-workspace-idor-and-hardcoded-aes-keyhttps://www.vulncheck.com/advisories/data-platform-open-through-commit-efeacd3-hardcoded-aes-key-for-datasource-passwords