{"id":"CVE-2026-111696","kind":"vulnerability","aliases":["CVE-2026-111696"],"related":[],"title":"data-platform-open: hardcoded AES key exposes stored datasource database passwords","description":"data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via cross-workspace IDOR, and decrypt them offline to recover plaintext database credentials.","summary":"data-platform-open encrypts stored datasource passwords with a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl. An authenticated attacker who reads ciphertext from the datasource detail API, including through a cross-workspace IDOR, can decrypt it offline and recover plaintext database credentials.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["data-platform-open","database-credentials","datasource","package","self-hosted"],"not_affected_if":["custom-encryption-key","newer-commit"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-16T18:17:53+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:36:30+00:00","updated_at":"2026-10-25T03:36:30+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:36:30Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"data-platform-open: hardcoded AES key exposes stored datasource database passwords","impact":"high","summary":"data-platform-open encrypts stored datasource passwords with a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl. An authenticated attacker who reads ciphertext from the datasource detail API, including through a cross-workspace IDOR, can decrypt it offline and recover plaintext database credentials.","category":"package","nicknames":[],"who_cares":["data-platform-open","self-hosted","datasource","database-credentials"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker recovers plaintext database credentials for connected datasources","analyst_note":"Find the fixed commit or release and whether the AES key is configurable, from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-111696) and the project repository.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["custom-encryption-key","newer-commit"],"who_is_affected":"Deployments of data-platform-open at or before commit efeacd3 that store datasource passwords with the default AES key in AesPasswordEncAndDecServiceImpl. Exposure also depends on whether authenticated users can reach the datasource detail API across workspaces. Installations that set their own encryption key or are on a later commit are likely unaffected, but the sources do not say which fixed version or configuration applies.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000615,"input_tokens":3348,"output_tokens":560,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111696':15A,18A '-2026':14A,17A 'ae':6A,45B,89C 'aespasswordencanddecserviceimpl':48B,92C 'allow':93C 'api':59B,110C 'attack':51B,95C,101C 'authent':50B,94C 'ciphertext':54B,104C 'commit':81C 'credenti':25B,75B,126C 'cross':64B,115C 'cross-workspac':63B,114C 'cve':13A,16A 'data':2A,20B,32B,77C 'data-platform-open':1A,19B,31B,76C 'databas':11A,24B,74B,125C 'database-credenti':23B 'datasourc':10A,26B,37B,57B,99C,108C 'decrypt':68B,97C,119C 'default':44B,88C 'detail':58B,109C 'efeacd3':82C 'encrypt':35B 'exampl':112C 'expos':8A 'hardcod':5A,41B,85C 'host':30B 'idor':66B,117C 'includ':60B 'key':7A,46B,90C 'known':43B,87C 'obtain':103C 'offlin':70B,121C 'open':4A,22B,34B,79C 'packag':27B 'password':12A,38B,100C,105C 'plaintext':73B,124C 'platform':3A,21B,33B,78C 'public':42B,86C 'read':53B 'recov':72B,123C 'self':29B 'self-host':28B 'store':9A,36B,98C 'use':83C 'via':113C 'workspac':65B,116C","nicknames":[],"mitigations":[],"who_affected":"Deployments of data-platform-open at or before commit efeacd3 that store datasource passwords with the default AES key in AesPasswordEncAndDecServiceImpl. Exposure also depends on whether authenticated users can reach the datasource detail API across workspaces. Installations that set their own encryption key or are on a later commit are likely unaffected, but the sources do not say which fixed version or configuration applies.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111696","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111696","severity":null,"published_at":"2026-10-16T18:17:53+00:00","modified_at":"2026-10-16T22:17:22+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}