DataLinkDC Dinky CVE-2026-122009

Exploitation requires reaching the flink_web Proxy Endpoint served by FlinkWebURITemplateProxyServlet in DataLinkDC Dinky (versions up to and including 1.2.5) and supplying an attacker-chosen value for the _authority argument used in getNewTargetUri to redirect the proxied request. The provided CVSS vector (PR:N/UI:N) indicates no authentication or user interaction is needed, making it remotely triggerable; however, the practical limiter is whether this admin-component proxy endpoint is network-reachable to the attacker (not firewalled off and, pending vendor confirmation, not behind authentication). Impact is constrained to low confidentiality/integrity/availability with no scope change to downstream systems, so the realistic outcome is internal-resource reachability/probing rather than direct code execution.

This is a medium-severity SSRF (CWE-918) with a vendor CVSS 4.0 base score of 6.9 and an attack-vector profile of AV:N/AC:L/AT:N/PR:N/UI:N - remotely reachable, low complexity, no authentication or user interaction indicated by the provided vector. Crucially, impact is bounded: VC:L/VI:L/VA:L with no subsequent-system scope (SC/SI/SA:N), so this is a low-impact SSRF rather than a full internal-compromise primitive, consistent with the sub-7 score. The E:P maturity flag and the description's statement that an exploit has been published raise urgency somewhat, but there is NO CISA KEV listing (not confirmed actively exploited) and NO EPSS score was supplied, so widespread or automated exploitation cannot be quantified from the available data. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with a real-but-non-emergency prioritization. Net: a genuine issue worth patching this cycle, not a drop-everything event. One caveat to verify with the vendor: the provided vector asserts PR:N (unauthenticated), yet the affected endpoint is an admin-side Flink web proxy servlet whose exposure may be gated by authentication in typical deployments - confirm whether the proxy endpoint is reachable pre-auth before treating this as fully unauthenticated.

A remote attacker sends a request to Dinky's flink_web proxy endpoint and manipulates the _authority argument handled by FlinkWebURITemplateProxyServlet.getNewTargetUri, causing the server to forward a request to an attacker-chosen host or internal service. This enables probing or reaching internal network resources from the Dinky server's vantage point. A public exploit has been disclosed per the CVE description, though it is not independently verified in the input as working exploit code.