EUVD-2026-103035
GHSA-33v5-488r-m83x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach unauthenticated /jobJdbcDatasource/test endpoint
-
DeliverySubmit crafted MySQL jdbcUrl with allowLoadLocalInfile=true
-
Exploitdata-dts opens connection to rogue server
-
ExecutionRogue MySQL issues LOCAL INFILE request
-
ImpactExfiltrate arbitrary files from host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the AllData data-dts component's /jobJdbcDatasource/test endpoint to be network-reachable; no authentication is needed (PR:N, confirmed by CWE-306 and the referenced WebSecurityConfiguration). The attacker must control or point to a rogue MySQL server and supply a jdbcUrl with the allowLoadLocalInfile=true parameter plus a jdbcDriverClass - the MySQL LOCAL INFILE abuse path is the specific enabling mechanism. Limiting factors: the data-dts service must be exposed to the attacker (often an internal-only service), file disclosure is constrained to files readable by the data-dts process account, and the attacker must host an attacker-controlled MySQL listener; impact is confidentiality-only (no write or availability effect). |
| Impact | Signals are moderate and largely consistent. The authoritative CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) describes a network-reachable, low-complexity, unauthenticated flaw (PR:N) with high confidentiality impact but NO integrity or availability impact (VI:N/VA:N), yielding 8.7 (High). CWE-306 (Missing Authentication) and the provided WebSecurityConfiguration.java reference corroborate the unauthenticated nature. No EPSS score, no CISA KEV listing, and no explicit POC flag were supplied in the input, so there is no public exploit identified at time of analysis - though a third-party hackmd technical writeup and a VulnCheck advisory are referenced, which document the technique in enough detail to materially aid reproduction. No SSVC decision data was provided. The practical risk is real but bounded: this is a file-disclosure primitive, not RCE - the CVSS impact is confidentiality-only, so claims of code execution would not be supported by the vector. The main caveat is reach: exploitation requires the data-dts component and its /jobJdbcDatasource/test endpoint to be network-exposed, which tempers the AV:N signal in typical internal deployments. Net: a genuine, straightforwardly exploitable unauthenticated information-disclosure bug in a niche open-source platform, not a mass-exploitation emergency absent KEV/EPSS evidence. |
| Exploit ScenarioDerived | An unauthenticated attacker reachable to the data-dts service stands up a rogue MySQL server and sends a request to /jobJdbcDatasource/test with a jdbcUrl pointing at that server and allowLoadLocalInfile=true. When data-dts opens the connection, the attacker's malicious MySQL server abuses the LOCAL INFILE mechanism to read arbitrary files (e.g., configuration or credential files) off the data-dts host. A public technical writeup describing this exact flow is referenced, lowering the barrier to reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Unauthenticated JDBC URL injection in the AllData data-dts component through version 0.7.1 allows any remote attacker who can reach the /jobJdbcDatasource/test endpoint to force the server to open an arbitrary database connection by supplying attacker-controlled jdbcUrl and jdbcDriverClass values. By pointing that URL at an attacker-hosted MySQL server with allowLoadLocalInfile=true, an attacker can abuse MySQL's LOCAL INFILE handling to read files from the data-dts host, giving high confidentiality impact (VC:H, VI:N, VA:N per our assessment) with no authentication required (PR:N, CWE-306). No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV; risk is concentrated in deployments where data-dts is network-exposed, and disclosure is limited to files readable by the data-dts process account.
RemediationAI
No vendor-released patch version is identified in the available data for CVE-2026-111613; affected users should treat AllData 0.7.1 and earlier data-dts deployments as vulnerable and track the upstream repository (https://github.com/alldatacenter/alldata) and the VulnCheck advisory for a fixed release. Until a patch ships, the most effective action is to stop exposing data-dts: place the service behind an authenticated reverse proxy or gateway and firewall/network-policy the /jobJdbcDatasource/test route so only trusted administrators can reach it - this directly neutralizes the missing authentication (CWE-306) that makes the issue exploitable, at the cost of breaking any legitimate unauthenticated callers. As defense in depth, enforce server-side validation of jdbcUrl and jdbcDriverClass by allowlisting permitted driver classes and rejecting URLs whose host is not an approved, internal database, and add egress filtering so the data-dts host cannot initiate outbound MySQL connections to arbitrary internet hosts (this blocks delivery to the attacker-controlled rogue MySQL listener, though it requires maintaining a destination allowlist). Where the bundled JDBC driver can be configured, disable LOCAL INFILE entirely (allowLoadLocalInfile=false and allowUrlInLocalInfile=false, and disable autoDeserialize) and upgrade MySQL Connector/J to a version where allowLoadLocalInfile defaults to false, which removes the file-read primitive even if the injection remains reachable; note that this may break legitimate bulk-load workloads. Finally, run data-dts under a least-privilege service account with no read access to sensitive files such as configuration, credential stores, and private keys, since discloseable files are limited to those readable by that account.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a missing-authentication issue (CWE-306) compounded by unsafe JDBC connection construction in AllData's data-dts service. Per the referenced source, JobDatasourceController.java (lines 131-135) exposes /jobJdbcDatasource/test, and BaseQueryTool.java (lines 107-124) takes the client-supplied jdbcUrl and jdbcDriverClass and uses them directly to establish a database connection without validating host, scheme, or driver. WebSecurityConfiguration.java is cited to explain why the route is reachable without credentials - the endpoint is not behind the expected authentication filter, so a remote, unauthenticated request reaches the vulnerable code path (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The specific enabling mechanism is MySQL Connector/J's LOCAL INFILE behavior: a jdbcUrl containing allowLoadLocalInfile=true instructs the driver to permit local file reads at the server's request, so the attacker presents a rogue MySQL listener as the 'database' and answers the injected query with a LOCAL INFILE request for a target file path on the data-dts host. That converts a simple connection-string injection into arbitrary file disclosure constrained only by the file permissions of the data-dts process account.
Know when Alldata gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Unauthenticated network endpoint (AV:N/PR:N/UI:N) with low-complexity abuse; arbitrary file read gives C:H, but no integrity or availability impact and no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with allowLoadLocalInfile=true pointing to an attacker-controlled server to read arbitrary files from the data-dts host.
Executive ViewAI
AllData data-dts deployments (through version 0.7.1) are affected by an unauthenticated JDBC URL injection vulnerability that could allow remote attackers to read files from the data-dts host, potentially exposing sensitive configuration or credential files accessible to the service account. This high-severity issue primarily impacts organizations with network-exposed data-dts instances, where an attacker could exploit the /jobJdbcDatasource/test endpoint without authentication to force arbitrary database connections. While no public exploit identified at time of analysis, leadership should act to restrict exposure and monitor for exploitation attempts until a vendor patch is available.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to the /jobJdbcDatasource/test endpoint (e.g., firewall rules, ACLs, or disabling the endpoint), ensuring data-dts is not internet-exposed through network segmentation, monitoring for anomalous JDBC connections or unexpected outbound MySQL traffic, and limiting file permissions for the data-dts service account to reduce the impact of file disclosure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Alldata v0.4.6 was discovered to contain a SQL injection vulnerability via the tablename parameter at /data/masterdata/d
Alldata V0.4.6 is vulnerable to Command execution vulnerability. Rated critical severity (CVSS 9.8), this vulnerability
A deserialization vulnerability in the FASTJSON component of Alldata v0.4.6 allows attackers to execute arbitrary comman
Path traversal in AllData up to version 0.6.8 enables remote unauthenticated attackers to read arbitrary files from the
Alldata V0.4.6 is vulnerable to Incorrect Access Control. Rated critical severity (CVSS 9.1), this vulnerability is remo
An issue in the system image upload interface of Alldata v0.4.6 allows attackers to execute a directory traversal when u
Alldata V0.4.6 is vulnerable to Insecure Permissions. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
An issue discovered in Alldata v0.4.6 allows attacker to run arbitrary commands via the processId parameter. Rated mediu
Exploit-DB