---
id: "CVE-2026-111613"
kind: "vulnerability"
aliases: ["CVE-2026-111613"]
title: "AllData: unauthenticated JDBC injection lets remote attackers read server files"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "alldata", "fixed": [], "affected": "<= 0.7.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["alldata", "data-dts", "file-read", "jdbc", "other", "self-hosted", "unauthenticated"]
not_affected_if: ["auth-required", "network-restricted", "not-internet-exposed"]
published_at: "2026-10-16T18:17:40+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-24T00:25:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111613", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:25:43+00:00"}]
---

# AllData: unauthenticated JDBC injection lets remote attackers read server files

AllData data-dts (through 0.7.1, the latest release) permits every request without authentication. POST /jobJdbcDatasource/test opens a database connection from an attacker-supplied jdbcUrl and driver class. A MySQL URL with allowLoadLocalInfile=true pointed at a rogue MySQL server makes the host send back any file it can read, such as configs and credentials. CVSS 4.0 8.7. No vendor fix or advisory yet.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:alldata affected <= 0.7.1 fixed ?

## How to check

Check whether you run AllData data-dts (module moat/studio/data-dts, default port 9536) at release 0.7.1 or earlier. From a host outside your trust zone, test whether the port answers: curl -i -X POST http://HOST:9536/jobJdbcDatasource/test -H 'Content-Type: application/json' -d '{}'. Any application-level response instead of 401/403 or a connection refusal means it is reachable unauthenticated. Also check egress logs for outbound MySQL (3306) connections from the host.

## Fix

No fixed version known: 0.7.1 is the latest release (2026-10-10) and the vendor has published nothing. Mitigate: do not expose the data-dts port to untrusted networks, block /jobJdbcDatasource/* at a reverse proxy or with auth, and block outbound traffic from the host except to known databases. Rotate any secrets stored in files readable by the service if exposure is possible.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111613
- 2026-10-24T00:25:43+00:00 analyst — Read reporter writeup (hackmd) and VulnCheck/CVE record: data-dts permitAll config makes POST /jobJdbcDatasource/test anonymous by default; 0.7.1 is latest release, no fixed version found. No public posts on X; PoC is illustrative only, no weaponized PoC link. Same writeup notes a hardcoded JWT secret (not in this CVE).

## Documents

- [advisory] AllData data-dts: unauthenticated JDBC URL injection (hieuPenguinnn) https://hackmd.io/@hieuPenguinnn/alldata-dts-unauthenticated-jdbc-url-injection
- [advisory] VulnCheck: AllData through 0.7.1 unauthenticated JDBC injection https://www.vulncheck.com/advisories/alldata-through-0.7.1-unauthenticated-jdbc-injection-via-jobjdbcdatasource-test

## From the sources

AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with allowLoadLocalInfile=true pointing to an attacker-controlled server to read arbitrary files from the data-dts host.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_