EUVD-2026-54238
GHSA-83jg-x5rh-3x8c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network GET with no complexity; only confidentiality is impacted as the endpoint returns read-only configuration data.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Dinky's SysConfigController.getAll() handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaCheckLogin, so the Sa-Token interceptor lets the request through with no session or role check. Any remote unauthenticated caller who can reach the Dinky HTTP port (8888 by default) receives the full live system configuration (54 entries on a stock v1.2.5 install) with one parameterless GET. Only one credential field (sys.maven.settings.repositoryPassword) has a desensitization handler wired; the other credential-bearing fields (sys.env.settings.dinkyToken, sys.ldap.settings.userPassword, sys.resource.settings.oss.accessKey and secretKey, and sys.dolphinscheduler.settings.token) return in cleartext. A bare install leaks the shipped defaults, including the hardcoded dinkyToken efda1551-7958-4e0f-80a8-dfd107df3e38 and minioadmin/minioadmin OSS keys; once an operator configures LDAP, object storage, or DolphinScheduler through the Settings Center, those live third-party credentials leak from the same endpoint. Because dinkyToken is the sole gate on the sibling POST /download/uploadFromRsByLocal arbitrary file write, this disclosure defeats token rotation as a mitigation for that vulnerability. Affects Dinky v1.2.5 (the current release, 2025-11-05) and the development branch (dev HEAD 63b5a5a), where the affected code is byte-identical.
AnalysisAI
Unauthenticated credential disclosure in Dinky v1.2.5 exposes the full live system configuration - including cleartext API tokens, LDAP passwords, and object storage keys - via a single parameterless GET request to /api/sysConfig/getAll. The root cause is a method-level @SaIgnore annotation that silently overrides the class-level @SaCheckLogin guard in the Sa-Token framework, leaving the endpoint fully unprotected on the default port 8888. Critically, the leaked dinkyToken directly unlocks a sibling arbitrary file write endpoint (POST /download/uploadFromRsByLocal), meaning this disclosure neutralises token rotation as a mitigation for that chained vulnerability; no public exploit has been identified at time of analysis.
Technical ContextAI
Dinky is an open-source real-time computing platform built on Apache Flink, with an embedded HTTP API server that defaults to port 8888. Access control is implemented via the Sa-Token framework, which supports class-level annotations (@SaCheckLogin) as the default gate and method-level annotations (@SaIgnore) as per-endpoint overrides. In SysConfigController, the class carries @SaCheckLogin but the getAll() method carries @SaIgnore; Sa-Token's interceptor processes method annotations first, causing the override to unconditionally bypass the class-level check rather than requiring both to be satisfied. CWE-306 (Missing Authentication for Critical Function) precisely describes the root cause: a function with significant security impact - returning 54 system-wide configuration key-value pairs - is reachable without any session, role, or token check. Of the credential-bearing configuration keys returned, only sys.maven.settings.repositoryPassword has a desensitization handler; sys.env.settings.dinkyToken, sys.ldap.settings.userPassword, sys.resource.settings.oss.accessKey, sys.resource.settings.oss.secretKey, and sys.dolphinscheduler.settings.token are returned in full cleartext. Affected code is byte-identical between the v1.2.5 release (2025-11-05) and the development branch at HEAD commit 63b5a5a.
RemediationAI
No vendor-released patch version has been identified at time of analysis; the disclosure references a GitHub issue (https://github.com/DataLinkDC/dinky/issues/4567) and a security advisory (https://github.com/DataLinkDC/dinky/security/advisories/GHSA-c48m-x2xw-32rj) which should be monitored for a fixed release. Until a patch is available, the highest-priority compensating control is to restrict network access to Dinky's HTTP port (default 8888) via firewall or network policy, permitting only trusted administrative subnets - this prevents unauthenticated external callers from reaching the endpoint entirely but does not protect against insider or compromised-internal-host scenarios. As a secondary control, operators should immediately rotate all credentials that Dinky stores in the Settings Center (LDAP user passwords, DolphinScheduler tokens, OSS access/secret keys, dinkyToken) and treat any values previously configured on an internet-reachable instance as fully compromised. Note that rotating dinkyToken alone is insufficient as long as the disclosure endpoint remains reachable, since each rotation is immediately re-exposed. Disabling or reversing the @SaIgnore annotation on SysConfigController.getAll() via a local source patch is feasible for teams running from source, but introduces a maintenance burden on future upgrades.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today