{"id":"CVE-2026-124558","kind":"vulnerability","aliases":["CVE-2026-124558"],"related":[],"title":"Dinky: SqlGateway connectAddress lets attackers force server-side requests","description":"A vulnerability has been found in DataLinkDC Dinky up to 1.2.5. The impacted element is the function SqlGateway.onOpen of the file SqlGateway.java of the component sql-gateway Endpoint. Such manipulation of the argument connectAddress leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The researcher claims to have submitted a GHSA on the repository of the project.","summary":"Dinky, a real-time data platform, has a server-side request forgery flaw in its SQL gateway endpoint, where the connectAddress argument is not validated. A remote attacker can make the Dinky server send requests to addresses of their choosing, including internal services the server can reach.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"dinky","fixed":[],"affected":"<= 1.2.5","ecosystem":"maven"}],"ecosystems":[],"tags":["dinky","java","package","self-hosted","sql-gateway"],"not_affected_if":["version-above-1.2.5"],"how_to_check":"- Check your Dinky version; <= 1.2.5 is listed as affected by NVD (no fixed version published yet).\n- Check whether the sql-gateway endpoint (SqlGateway.onOpen) is reachable from untrusted networks; restrict it to trusted networks and limit the server's outbound access to internal services.","fix":"unknown: no fixed version found; the vendor advisory GHSA-x4hx-f425-mrx6 was not readable (404) on 2026-11-09","status":"open","published_at":"2026-11-09T03:16:37+00:00","first_seen_at":"2026-11-09T03:24:19+00:00","triaged_at":"2026-11-09T03:26:23+00:00","updated_at":"2026-11-09T03:27:15+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-11-09T03:26:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Dinky: SqlGateway connectAddress lets attackers force server-side requests","impact":"medium","summary":"Dinky, a real-time data platform, has a server-side request forgery flaw in its SQL gateway endpoint, where the connectAddress argument is not validated. A remote attacker can make the Dinky server send requests to addresses of their choosing, including internal services the server can reach.","audience":"businesses","category":"package","nicknames":[],"who_cares":["dinky","sql-gateway","java","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"server sends requests to internal addresses on attacker's behalf","analyst_note":"Check the linked GHSA/vendor advisory on github.com for the fixed version and whether authentication is required; sources give no fix.","how_to_check":"- Check the Dinky version in use; versions up to and including `1.2.5` are listed as affected.\n- Check whether the sql-gateway endpoint (SqlGateway.onOpen) is reachable from untrusted networks.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-above-1.2.5"],"who_is_affected":"Teams running DataLinkDC Dinky up to version 1.2.5 with the sql-gateway endpoint reachable from the network. The sources do not state which deployment settings are needed to reach the vulnerable code, so whether a given install is exposed is unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000746,"input_tokens":4616,"output_tokens":569,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the linked GHSA/vendor advisory on github.com for the fixed version and whether authentication is required; sources give no fix.","search":"'-124558':13A,16A '-2026':12A,15A '1.2.5':86C 'address':65B 'argument':50B,109C 'attack':5A,56B,124C 'choos':68B 'claim':140C 'compon':100C 'connectaddress':3A,49B,110C 'cve':11A,14A 'data':32B 'datalinkdc':82C 'dinki':1A,18B,27B,60B,83C 'dinky':17A 'disclos':130C 'element':89C 'endpoint':46B,104C 'exploit':127C 'file':96C 'flaw':41B 'forc':6A 'forgeri':40B,117C 'found':80C 'function':92C 'gateway':26B,45B,103C 'ghsa':145C 'host':23B 'impact':88C 'includ':69B 'intern':70B 'java':19B 'launch':122C 'lead':111C 'let':4A 'make':58B 'manipul':106C 'may':135C 'packag':20B 'platform':33B 'possibl':120C 'project':151C 'public':133C 'reach':75B 'real':30B 'real-tim':29B 'remot':55B,125C 'repositori':148C 'request':10A,39B,63B,116C 'research':139C 'self':22B 'self-host':21B 'send':62B 'server':8A,37B,61B,73B,114C 'server-sid':7A,36B,113C 'servic':71B 'side':9A,38B,115C 'sql':25B,44B,102C 'sql-gateway':24B,101C 'sqlgateway':2A 'sqlgateway.java':97C 'sqlgateway.onopen':93C 'submit':143C 'time':31B 'use':137C 'valid':53B 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Teams running DataLinkDC Dinky up to version 1.2.5 with the sql-gateway endpoint reachable from the network. The sources do not state which deployment settings are needed to reach the vulnerable code, so whether a given install is exposed is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["dinky"],"ptokens":["dinky"],"labels":["dinky","high","java","package","selfhosted","sqlgateway"],"campaign_type":null,"search_a":"'-124558':13A,16A '-2026':12A,15A 'attack':5A 'connectaddress':3A 'cve':11A,14A 'dinki':1A 'dinky':17A 'forc':6A 'let':4A 'request':10A 'server':8A 'server-sid':7A 'side':9A 'sqlgateway':2A","search_b":"'address':65B 'argument':50B 'attack':56B 'choos':68B 'connectaddress':49B 'data':32B 'dinki':18B,27B,60B 'endpoint':46B 'flaw':41B 'forgeri':40B 'gateway':26B,45B 'host':23B 'includ':69B 'intern':70B 'java':19B 'make':58B 'packag':20B 'platform':33B 'reach':75B 'real':30B 'real-tim':29B 'remot':55B 'request':39B,63B 'self':22B 'self-host':21B 'send':62B 'server':37B,61B,73B 'server-sid':36B 'servic':71B 'side':38B 'sql':25B,44B 'sql-gateway':24B 'time':31B 'valid':53B","search_c":"'1.2.5':86C 'argument':109C 'attack':124C 'claim':140C 'compon':100C 'connectaddress':110C 'datalinkdc':82C 'dinki':83C 'disclos':130C 'element':89C 'endpoint':104C 'exploit':127C 'file':96C 'forgeri':117C 'found':80C 'function':92C 'gateway':103C 'ghsa':145C 'impact':88C 'launch':122C 'lead':111C 'manipul':106C 'may':135C 'possibl':120C 'project':151C 'public':133C 'remot':125C 'repositori':148C 'request':116C 'research':139C 'server':114C 'server-sid':113C 'side':115C 'sql':102C 'sql-gateway':101C 'sqlgateway.java':97C 'sqlgateway.onopen':93C 'submit':143C 'use':137C 'vulner':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T03:16:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124558","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124558","severity":null,"published_at":"2026-11-09T03:16:37+00:00","modified_at":"2026-11-09T03:16:38+00:00","first_seen_at":"2026-11-09T03:24:19+00:00","fetched_at":"2026-11-09T03:24:19+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124558:2237","url":null,"severity":null,"published_at":"2026-11-09T03:27:15+00:00","modified_at":"2026-11-09T03:27:15+00:00","first_seen_at":"2026-11-09T03:27:15+00:00","fetched_at":"2026-11-09T03:27:15+00:00","note":"Linked GHSA returns 404 (likely unpublished/private); web-cli out of Exa credits. Only NVD/VulDB text: Dinky <= 1.2.5, SqlGateway.onOpen connectAddress SSRF, remote, PoC disclosed publicly per VulDB (no link found). Fix, auth requirement unknown; nothing verified. Revisit when GHSA is published."}],"documents":[{"id":105427,"url":"https://github.com/DataLinkDC/dinky/security/advisories/GHSA-x4hx-f425-mrx6","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}