CVE-2026-124558: falha de média gravidade em DataLinkDC Dinky
DataLinkDC Dinky sql-gateway Endpoint SqlGateway.java SqlGateway.onOpen server-side request forgery
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
10Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9
A vulnerability has been found in DataLinkDC Dinky up to 1.2.5. The impacted element is the function SqlGateway.onOpen of the file SqlGateway.java of the component sql-gateway Endpoint. Such manipulation of the argument connectAddress leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The researcher claims to have submitted a GHSA on the repository of the project.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
DataLinkDC · DinkyCVEs relacionadas — DataLinkDC Dinky
No mesmo produto, das mais perigosas para as menos.
CVE-2026-70558CRITICALDinky Unauthenticated Arbitrary File Write via /download/uploadFromRsByLocal Gated Only by Hardcoded Default TokenEPSS 0.8%CVE-2026-122009MEDIUMDataLinkDC Dinky flink_web Proxy Endpoint FlinkWebURITemplateProxyServlet.java FlinkWebURITemplateProxyServlet.getNewTargetUri server-side request forgeryEPSS 0.5%CVE-2026-70559HIGHDinky Unauthenticated System Configuration and Credential Disclosure via GET /api/sysConfig/getAllEPSS 0.5%CVE-2026-124326MEDIUMDataLinkDC Dinky Catalogue Upload CatalogueController.java file.getOriginalFilename path traversalEPSS 0.4%