{"id":"CVE-2026-111613","kind":"vulnerability","aliases":["CVE-2026-111613"],"related":[],"title":"AllData: unauthenticated JDBC injection lets remote attackers read server files","description":"AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with allowLoadLocalInfile=true pointing to an attacker-controlled server to read arbitrary files from the data-dts host.","summary":"AllData data-dts (through 0.7.1, the latest release) permits every request without authentication. POST /jobJdbcDatasource/test opens a database connection from an attacker-supplied jdbcUrl and driver class. A MySQL URL with allowLoadLocalInfile=true pointed at a rogue MySQL server makes the host send back any file it can read, such as configs and credentials. CVSS 4.0 8.7. No vendor fix or advisory yet.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"alldata","fixed":[],"affected":"<= 0.7.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["alldata","data-dts","file-read","jdbc","other","self-hosted","unauthenticated"],"not_affected_if":["auth-required","network-restricted","not-internet-exposed"],"how_to_check":"Check whether you run AllData data-dts (module moat/studio/data-dts, default port 9536) at release 0.7.1 or earlier. From a host outside your trust zone, test whether the port answers: curl -i -X POST http://HOST:9536/jobJdbcDatasource/test -H 'Content-Type: application/json' -d '{}'. Any application-level response instead of 401/403 or a connection refusal means it is reachable unauthenticated. Also check egress logs for outbound MySQL (3306) connections from the host.","fix":"No fixed version known: 0.7.1 is the latest release (2026-10-10) and the vendor has published nothing. Mitigate: do not expose the data-dts port to untrusted networks, block /jobJdbcDatasource/* at a reverse proxy or with auth, and block outbound traffic from the host except to known databases. Rotate any secrets stored in files readable by the service if exposure is possible.","status":"open","published_at":"2026-10-16T18:17:40+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:39:03+00:00","updated_at":"2026-10-24T00:25:43+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T22:39:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"AllData: unauthenticated JDBC injection lets remote attackers read server files","impact":"high","summary":"AllData through 0.7.1 exposes a data-dts endpoint that opens arbitrary database connections from attacker-supplied JDBC URLs and drivers without authentication. A crafted MySQL URL with allowLoadLocalInfile=true makes the server read arbitrary files from its host and send them to an attacker-controlled database.","category":"other","who_cares":["alldata","self-hosted","data-dts"],"confidence":0.7,"needs_auth":"no","worst_case":"Remote attacker reads arbitrary files from the data-dts host","analyst_note":"Confirm the fixed version and whether the /jobJdbcDatasource/test endpoint is reachable by default; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-111613 and the AllData project repository.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required","network-restricted"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000503,"input_tokens":2971,"output_tokens":411,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether the /jobJdbcDatasource/test endpoint is reachable by default; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-111613 and the AllData project repository.","search":"'-111613':13A,16A '-2026':12A,15A '/jobjdbcdatasource/test':46B,125C '0.7.1':36B,98C '4.0':88B '8.7':89B 'advisori':94B 'alldata':1A,17A,18B,31B,96C 'allow':106C 'allowloadlocalinfil':64B,135C 'arbitrari':111C,146C 'attack':7A,54B,108C,127C,141C 'attacker-control':140C 'attacker-suppli':53B 'authent':44B 'back':76B 'class':59B 'config':84B 'connect':50B,113C 'contain':99C 'control':142C 'credenti':86B 'cve':11A,14A 'cvss':87B 'data':20B,33B,123C,151C 'data-dt':19B,32B,122C,150C 'databas':49B,112C 'driver':58B 'dts':21B,34B,124C,152C 'endpoint':126C 'everi':41B 'file':10A,23B,78B,147C 'file-read':22B 'fix':92B 'host':29B,74B,153C 'inject':4A,103C 'jdbc':3A,25B,102C,132C 'jdbcdriverclass':118C 'jdbcurl':56B,116C 'latest':38B 'let':5A 'make':72B 'mysql':61B,70B,131C 'open':47B,110C 'permit':40B 'point':66B,137C 'post':45B 'read':8A,24B,81B,145C 'releas':39B 'remot':6A,107C 'request':42B 'rogu':69B 'self':28B 'self-host':27B 'send':75B 'server':9A,71B,143C 'suppli':55B,115C,129C 'true':65B,136C 'unauthent':2A,30B,101C 'url':62B,133C 'valu':119C 'vendor':91B 'vulner':104C 'without':43B 'yet':95B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:40+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111613","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111613","severity":null,"published_at":"2026-10-16T18:17:40+00:00","modified_at":"2026-10-23T19:17:42+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111613:660","url":null,"severity":null,"published_at":"2026-10-24T00:25:43+00:00","modified_at":"2026-10-24T00:25:43+00:00","first_seen_at":"2026-10-24T00:25:43+00:00","fetched_at":"2026-10-24T00:25:43+00:00","note":"Read reporter writeup (hackmd) and VulnCheck/CVE record: data-dts permitAll config makes POST /jobJdbcDatasource/test anonymous by default; 0.7.1 is latest release, no fixed version found. No public posts on X; PoC is illustrative only, no weaponized PoC link. Same writeup notes a hardcoded JWT secret (not in this CVE)."}],"documents":[{"id":2597,"url":"https://hackmd.io/@hieuPenguinnn/alldata-dts-unauthenticated-jdbc-url-injection","title":"AllData data-dts: unauthenticated JDBC URL injection (hieuPenguinnn)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2599,"url":"https://www.vulncheck.com/advisories/alldata-through-0.7.1-unauthenticated-jdbc-injection-via-jobjdbcdatasource-test","title":"VulnCheck: AllData through 0.7.1 unauthenticated JDBC injection","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}