Live › vulnerability › CVE-2026-111692
Go to dashboardDataBuff ai-apm-web (<= 0.1.10) signs session tokens with a public default HMAC secret. The source-tree application.yml sets apm.security.jwt.secret: dev-secret, and the code falls back to change-me-in-production when the property is unset. The Docker image config does not set it. An unauthenticated attacker who can reach port 27403 can forge an 'admin|<future-epoch>' token and get full admin on /webapi routes, including POST /webapi/api/v1/ai/doris/query (read-only SQL), AI sessions, LLM provider config and alert/webhook config. The default admin login is also admin / Databuff@123. The researcher's writeup includes the exploit steps, but the author says they were not run against a live deployment. No exploitation in the wild is known.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| databuff ai-apm-web | github | <= 0.1.10 | – |
docker ps | grep ai-apm-web, with tag <= 0.1.10v0.1.10 is the latestEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain full administrative access to protected /webapi routes, including the Doris SQL query API.
This page as .md · .json · in your agent: get_signal("CVE-2026-111692")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.