---
id: "CVE-2026-124558"
page: "https://infrastack.ai/live/CVE-2026-124558"
kind: "vulnerability"
aliases: ["CVE-2026-124558"]
title: "Dinky: SqlGateway connectAddress lets attackers force server-side requests"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "dinky", "fixed": [], "affected": "<= 1.2.5", "ecosystem": "maven"}]
ecosystems: []
tags: ["dinky", "java", "package", "self-hosted", "sql-gateway"]
not_affected_if: ["version-above-1.2.5"]
published_at: "2026-11-09T03:16:37+00:00"
first_seen_at: "2026-11-09T03:24:19+00:00"
updated_at: "2026-11-09T03:27:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124558", "first_seen_at": "2026-11-09T03:24:19+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-09T03:27:15+00:00"}]
exploit_sources: []
---

# Dinky: SqlGateway connectAddress lets attackers force server-side requests

Link for people: https://infrastack.ai/live/CVE-2026-124558 (this .md is for agents)

Dinky, a real-time data platform, has a server-side request forgery flaw in its SQL gateway endpoint, where the connectAddress argument is not validated. A remote attacker can make the Dinky server send requests to addresses of their choosing, including internal services the server can reach.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:dinky affected <= 1.2.5 fixed no fixed version listed

## How to check

- Check your Dinky version; <= 1.2.5 is listed as affected by NVD (no fixed version published yet).
- Check whether the sql-gateway endpoint (SqlGateway.onOpen) is reachable from untrusted networks; restrict it to trusted networks and limit the server's outbound access to internal services.

## Fix

unknown: no fixed version found; the vendor advisory GHSA-x4hx-f425-mrx6 was not readable (404) on 2026-11-09

## Timeline

- 2026-11-09T03:24:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124558
- 2026-11-09T03:27:15+00:00 analyst — Linked GHSA returns 404 (likely unpublished/private); web-cli out of Exa credits. Only NVD/VulDB text: Dinky <= 1.2.5, SqlGateway.onOpen connectAddress SSRF, remote, PoC disclosed publicly per VulDB (no link found). Fix, auth requirement unknown; nothing verified. Revisit when GHSA is published.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/DataLinkDC/dinky/security/advisories/GHSA-x4hx-f425-mrx6

## From the sources

A vulnerability has been found in DataLinkDC Dinky up to 1.2.5. The impacted element is the function SqlGateway.onOpen of the file SqlGateway.java of the component sql-gateway Endpoint. Such manipulation of the argument connectAddress leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The researcher claims to have submitted a GHSA on the repository of the project.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_