Live › vulnerability › CVE-2026-111693
Go to dashboardDataBuff ai-apm-web through version 0.1.10 ships with a built-in admin account using a hard-coded password. An unauthenticated attacker can log in with that default admin/Databuff@123 pair and get an administrator token for all protected /webapi routes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check whether a DataBuff ai-apm-web instance is reachable and try POST /webapi/api/v1/auth/login with admin/Databuff@123.
Upgrade past 0.1.10 if a fixed release exists, or change the admin password and block /webapi from untrusted networks.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator token and access all protected /webapi routes.
This page as .md · .json · in your agent: get_signal("CVE-2026-111693")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.