Data Platform Open Vulnerability: Hardcoded AES Key for Decrypting Data Source Passwords

CVE-2026-111696

What is CVE-2026-111696?

The Data Platform Open product features a serious vulnerability present in the AesPasswordEncAndDecServiceImpl class, where a hardcoded AES key is used for encrypting and decrypting datasource passwords. This flaw allows authenticated attackers to exploit the vulnerability by obtaining ciphertext passwords through insecure API endpoints. By leveraging techniques such as cross-workspace IDOR (Insecure Direct Object Reference), attackers can gain access to sensitive ciphertext credentials. Once obtained, these credentials can be decrypted offline, resulting in a full compromise of the underlying database security.

References