Live › vulnerability › CVE-2026-111613
Go to dashboardAllData data-dts (through 0.7.1, the latest release) permits every request without authentication. POST /jobJdbcDatasource/test opens a database connection from an attacker-supplied jdbcUrl and driver class. A MySQL URL with allowLoadLocalInfile=true pointed at a rogue MySQL server makes the host send back any file it can read, such as configs and credentials. CVSS 4.0 8.7. No vendor fix or advisory yet.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| alldata | vendor | <= 0.7.1 | – |
0.7.1 or earlierContent-Type: application/json -d {}0.7.1 is the latest release (2026-10-10) and the vendor has published nothingEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with allowLoadLocalInfile=true pointing to an attacker-controlled server to read arbitrary files from the data-dts host.
This page as .md · .json · in your agent: get_signal("CVE-2026-111613")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.