Unauthorized Access to System Configuration in Dinky by DataLinkDC

CVE-2026-70559

What is CVE-2026-70559?

The vulnerability allows remote unauthenticated attackers to access sensitive system configurations in Dinky via a specific API endpoint. The SysConfigController.getAll() method's improper configuration bypasses necessary authentication checks, exposing sensitive fields, including hardcoded credentials and configuration settings. Specifically, while some fields have desensitization handlers, many others, including critical access keys for external services, are returned in cleartext. The lack of authentication can lead to exploitation, compromising the integrity and confidentiality of the affected system.

References