DINKY · CVE-2026-124558 · Package
NO FIX YET · SEE WHAT TO DO
Dinky, a real-time data platform, has a server-side request forgery flaw in its SQL gateway endpoint, where the connectAddress argument is not validated. A remote attacker can make the Dinky server send requests to addresses of their choosing, including internal services the server can reach.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running DataLinkDC Dinky up to version 1.2.5 with the sql-gateway endpoint reachable from the network. The sources do not state which deployment settings are needed to reach the vulnerable code, so whether a given install is exposed is unknown.
Not affected if version-above-1.2.5
Who cares dinky, java, self-hosted, sql-gateway
unknown: no fixed version found; the vendor advisory GHSA-x4hx-f425-mrx6 was not readable (404) on 2026-11-09
A vulnerability has been found in DataLinkDC Dinky up to 1.2.5. The impacted element is the function SqlGateway.onOpen of the file SqlGateway.java of the component sql-gateway Endpoint. Such manipulation of the argument connectAddress leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The researcher claims to have submitted a GHSA on the repository of the project.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.