EUVD-2026-119784
GHSA-9hhv-xrpj-v2gw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Dinky sql-gateway endpoint
-
ExploitSupply malicious connectAddress value
-
ExecutionServer issues forged outbound request
-
ImpactAccess internal/restricted network resource
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires reaching the sql-gateway Endpoint and invoking the SqlGateway.onOpen function with a crafted 'connectAddress' argument, which the server then uses to establish a connection - this specific parameter is the injection point. The CVSS vector lists PR:N/UI:N, implying no authentication or user interaction, but the sources do not describe access control on this endpoint, so whether the gateway is exposed unauthenticated in default deployments is unverified. Realistic exploitation is limited to environments where the Dinky sql-gateway endpoint is network-reachable by the attacker (e.g., exposed internal or internet-facing management interface up to version 1.2.5); impact is bounded to low (SSRF typically enabling internal reconnaissance or restricted-resource access rather than direct code execution per VC:L/VI:L/VA:L). |
| Impact | This is a medium-severity SSRF (CWE-918) in DataLinkDC Dinky's sql-gateway endpoint, reachable remotely. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a network-reachable flaw requiring no privileges or user interaction, but impact is constrained to low across confidentiality, integrity and availability (VC:L/VI:L/VA:L), yielding 6.9. The E:P (Proof-of-Concept) exploit maturity and the VulDB statement that the exploit was disclosed publicly raise exposure, but there is no CISA KEV listing and no EPSS score in the input, so there is no evidence of active or widespread exploitation - exploitation status is 'publicly disclosed PoC, not confirmed exploited in the wild.' The vuln.today decision label is 'this_month,' consistent with a real-but-not-emergency priority: patch on a normal cycle rather than treat as an immediate incident. Key caveat: PR:N claims the endpoint is unauthenticated, but the sources do not describe the access control around SqlGateway.onOpen, so whether the gateway endpoint is exposed without authentication in default deployments is unverified and should be confirmed against the GHSA advisory. |
| Exploit ScenarioDerived | A remote attacker sends a request to Dinky's sql-gateway endpoint (the SqlGateway.onOpen handler) with a manipulated 'connectAddress' argument pointing at an internal host or metadata service, causing the server to issue an attacker-controlled outbound request. A public PoC reference exists (it is not verified as working exploit code), lowering the barrier to replication. Because the CVSS vector is AV:N/AC:L/PR:N, the request can be made remotely with low complexity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 09, 2026
Server-side request forgery in DataLinkDC Dinky up to and including 1.2.5 lets remote attackers make the server issue requests to attacker-chosen destinations through the 'connectAddress' argument of SqlGateway.onOpen in the sql-gateway endpoint. The CVSS vector (AV:N/AC:L/PR:N/UI:N) and the assessed conditions show exploitation only requires reaching the sql-gateway endpoint and invoking that function, although the sources do not document access control on the endpoint, so whether it is unauthenticated in default deployments is unverified; scored impact is low (VC:L/VI:L/VA:L), consistent with internal reconnaissance or reaching restricted resources rather than code execution. An exploit disclosure is public according to the reporting sources and CVSS 4.0 exploit maturity is rated P, but the PoC is not independently verified as working exploit code and no active exploitation (CISA KEV) is reported.
RemediationAI
No vendor-released patch is identified in the available sources, and no fixed version number should be assumed; administrators should track GHSA-x4hx-f425-mrx6 at https://github.com/DataLinkDC/dinky/security/advisories/GHSA-x4hx-f425-mrx6 and the vendor project page for a patched release and upgrade as soon as one is published. Until then, the primary control is to remove attacker reachability of the vulnerable surface: restrict network access to the Dinky sql-gateway endpoint so that only trusted administrative networks or hosts can invoke it (firewall rules, security groups or a reverse proxy with authentication in front of the gateway), accepting that legitimate gateway clients outside that allow-list will lose access. Where the sql-gateway functionality is not required, keep the endpoint unreachable or undeployed, with the trade-off that dependent SQL gateway workflows stop functioning. Because the flaw turns the Dinky server into a request originator, egress filtering on the Dinky host or container - denying outbound connections to internal management networks, metadata services and other sensitive address ranges while permitting only the destinations the gateway legitimately needs - limits the value of a successful SSRF, at the cost of possible breakage for valid data sources. Reviewing outbound connection logs from the Dinky server for unexpected destination addresses supports detection in the absence of a patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Dinky is a Java-based data development platform (tags: Java, SSRF, Dinky), and the affected element is a component referred to as the sql-gateway Endpoint, specifically the SqlGateway.onOpen function in SqlGateway.java. The flaw is CWE-918 (Server-Side Request Forgery): the 'connectAddress' argument supplied to onOpen is used by the server to establish a connection, making that parameter the injection point through which an attacker can direct server-side requests to a destination of their choosing. The CPE entry cpe:2.3:a:datalinkdc:dinky:*:*:*:*:*:*:*:* uses a wildcard version, and the affected range is bounded only by the advisory text (up to 1.2.5). The sources describe the injection point and the resulting SSRF, but they do not state what validation, allow-listing or protocol handling exists on connectAddress before the connection is made, and the trigger beyond invoking onOpen with a crafted connectAddress is not described in the available sources. Exploitation is contingent on network reachability of the sql-gateway endpoint, and the researcher reports having submitted a GHSA (GHSA-x4hx-f425-mrx6) to the project repository.
Know when Dinky gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable SSRF with low complexity and no auth/UI per the supplied vector; impact kept low (C:L/I:L) as SSRF enables limited internal access, not full compromise, A:N.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability has been found in DataLinkDC Dinky up to 1.2.5. The impacted element is the function SqlGateway.onOpen of the file SqlGateway.java of the component sql-gateway Endpoint. Such manipulation of the argument connectAddress leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The researcher claims to have submitted a GHSA on the repository of the project.
Threat Intelligence Overview
NVD
CVE.org
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Dinky versions up to 1.2.5 contain an authentication bypass in the OpenAPI endpoint handler that allows unauthenticated
Path traversal in Dinky up to version 1.2.5 allows authenticated remote attackers to access arbitrary files on the syste
Server-side request forgery in Dinky up to version 1.2.5 allows authenticated attackers to make arbitrary HTTP requests
Server-side request forgery in DataLinkDC Dinky through version 1.2.5 lets a remote, unauthenticated attacker control th
Path traversal in the catalogue upload endpoint of DataLinkDC Dinky through 1.2.5 lets an authenticated low-privilege us
Path traversal in DataLinkDC Dinky through 1.2.5 lets a low-privileged authenticated user manipulate the filename argume
Exploit-DB