EUVD-2026-102984
GHSA-4hh4-c7m4-34wx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDiscover exposed /webapi login endpoint
-
ExploitPOST hard-coded admin/Databuff@123 credentials
-
ExecutionReceive administrator JWT token
-
ImpactAccess and control all protected /webapi admin routes
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Default credential prevention
|
| Exploitation Conditions | Exploitation requires only that the built-in admin account (username admin, password Databuff@123) remains at its shipped default and that the /webapi/api/v1/auth/login endpoint is network-reachable to the attacker - the default state for DataBuff ai-apm-web through 0.1.10. No user interaction, no prior authentication, and no non-default feature toggle are needed. The single effective mitigating factor is operator action: if an administrator has changed the default password (or the instance is not network-exposed), the attack fails; there is no platform/version nuance beyond the ≤0.1.10 version ceiling. |
| Impact | This is a genuine high-priority issue, not an inflated-CVSS artifact. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) describes network-reachable, low-complexity, unauthenticated exploitation yielding full confidentiality, integrity and availability impact to the application - and the description corroborates every one of those metrics (POST to /webapi/api/v1/auth/login with a built-in credential returns an administrator token). CWE-1392 (use of default credentials) is one of the most reliably exploitable weakness classes because it requires no memory-corruption skill and no race. The limiting signal is deployment scope: DataBuff ai-apm-web is an obscure open-source APM product (databufflabs), so the real-world blast radius is small. No EPSS score, no CISA KEV listing, and no explicit POC flag were provided in the input, so 'actively exploited' cannot be asserted; however, the published hackmd write-up and the fact that the working credential (admin/Databuff@123) is disclosed verbatim in the advisory make reproduction trivial. Net: treat as critical-severity-per-instance but low aggregate exposure - prioritize for anyone actually running DataBuff, deprioritize relative to ubiquitous-product criticals. |
| Exploit ScenarioDerived | An attacker locates an internet- or network-exposed DataBuff ai-apm-web instance (version ≤0.1.10) and sends a single HTTP POST to /webapi/api/v1/auth/login containing the hard-coded credential admin/Databuff@123. The server returns a valid administrator JWT, which the attacker replays against every protected /webapi route to read monitoring data and fully administer the platform. No exploit toolkit is required - the credential is published in the advisory and a methodology write-up exists on hackmd, so weaponization is effectively instant. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
DataBuff ai-apm-web through 0.1.10 ships with a hard-coded administrator account (admin / Databuff@123), allowing unauthenticated remote attackers to POST those credentials to /webapi/api/v1/auth/login and receive an administrator token. That token grants access to all protected /webapi routes, yielding full confidentiality, integrity, and availability impact on affected deployments. No public exploit identified at time of analysis, but exploitation is trivial if the built-in admin password remains default and the login endpoint is network-reachable; independent assessment finds this a genuine high-priority issue, not an inflated-CVSS artifact.
RemediationAI
No vendor-released patch identified at time of analysis, so remediation must start with immediate credential rotation: change the built-in admin password from Databuff@123 and, if the application supports it, disable or rename the default admin account after creating an alternate administrative account. Restrict network access to /webapi/api/v1/auth/login and all /webapi routes to trusted management networks or VPN, accepting that this may limit legitimate remote administration. Monitor authentication logs for POSTs to /webapi/api/v1/auth/login using the admin username or the default password, and review https://www.vulncheck.com/advisories/databuff-ai-apm-web-through-0.1.10-hard-coded-default-admin-credentials and https://github.com/databufflabs/databuff for updated guidance. If an upgrade beyond 0.1.10 becomes available, apply it as the definitive fix; until then these compensating controls do not remove the hard-coded credential from the codebase.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-1392 (Use of Default Credentials) is the root cause: DataBuff ai-apm-web through 0.1.10 embeds a default administrator account in PortalUserManagementService.java, referenced in the vendor GitHub repository. The /webapi/api/v1/auth/login endpoint validates these static credentials and issues an administrator token, so the application authorization model collapses to a known secret. The CPE cpe:2.3:a:databufflabs:databuff:*:*:*:*:*:*:*:* maps to the DataBuff product line, while the advisory scope is specifically ai-apm-web 0.1.10 and earlier. No prior authentication or user interaction is required per the PR:N/UI:N vector, and impact spans confidentiality, integrity, and availability (C:H/I:H/A:H).
Know when Databuff gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Known default credential over the network with no auth or interaction gives AV:N/AC:L/PR:N/UI:N; admin takeover of the single app yields C:H/I:H/A:H with S:U (no cross-system scope change).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator token and access all protected /webapi routes.
Executive ViewAI
DataBuff ai-apm-web through version 0.1.10 ships with a hard-coded administrator credential, so any party able to reach the application's login interface can obtain full administrative control of the deployment. That level of access exposes all protected application interfaces, giving an attacker complete impact across data confidentiality, integrity, and availability. Leadership should treat every deployed instance as a priority containment item until the vendor publishes a fixed release.
No vendor-released patch identified at time of analysis. Interim mitigations: block or restrict network access to /webapi/api/v1/auth/login and the protected /webapi routes via firewall, reverse proxy, or WAF rules; replace the built-in administrator password (DataBuff@123) with a strong unique credential and disable the built-in admin account where possible; segment affected deployments onto isolated management networks; monitor and alert on authentication attempts and administrative sessions against the affected endpoints; escalate to the vendor for a fixed release.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB