Server-Side Request Forgery Vulnerability in DataLinkDC Dinky by DataLinkDC
CVE-2026-124558

6.9MEDIUM

Key Information:

Vendor

Datalinkdc

Status
Dinky
Vendor
CVE Published:
9 November 2026

What is CVE-2026-124558?

A vulnerability has been identified in the DataLinkDC Dinky product, specifically within the sql-gateway Endpoint's SqlGateway.onOpen function in SqlGateway.java. A flaw occurs due to improper handling of the connectAddress argument, leading to the possibility of server-side request forgery (SSRF). This vulnerability can be exploited remotely, potentially allowing unauthorized access to internal resources. The exploit has already been disclosed publicly, indicating an immediate need for users of affected versions to apply relevant security measures.

Affected Version(s)

Dinky 1.2.0

Dinky 1.2.1

Dinky 1.2.2

References

https://vuldb.com/vuln/432891
vdb-entrytechnical-description
https://vuldb.com/vuln/432891/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-124558
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lucasg2g (VulDB User)
VulDB CNA Team
.