Live › vulnerability › CVE-2026-111696
Go to dashboarddata-platform-open encrypts stored datasource passwords with a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl. An authenticated attacker who reads ciphertext from the datasource detail API, including through a cross-workspace IDOR, can decrypt it offline and recover plaintext database credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments of data-platform-open at or before commit efeacd3 that store datasource passwords with the default AES key in AesPasswordEncAndDecServiceImpl. Exposure also depends on whether authenticated users can reach the datasource detail API across workspaces. Installations that set their own encryption key or are on a later commit are likely unaffected, but the sources do not say which fixed version or configuration applies.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via cross-workspace IDOR, and decrypt them offline to recover plaintext database credentials.
This page as .md · .json · in your agent: get_signal("CVE-2026-111696")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.