CVE-2026-111613
7.5HighPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-306
Impact
Remote, unauthenticated attackers can read arbitrary files from the data-dts server host. They only need network access to reach the exposed /jobJdbcDatasource/test endpoint and an attacker-controlled MySQL server.
Root cause
The /jobJdbcDatasource/test endpoint lacks authentication and instantiates arbitrary JDBC connections using caller-supplied URLs and driver classes without sanitization.
Affected systems
AllData through 0.7.1
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Fix & remediation
No fixed version is specified in the advisory; restrict network access to the data-dts service or block requests to the /jobJdbcDatasource/test endpoint at your reverse proxy or firewall.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with allowLoadLocalInfile=true pointing to an attacker-controlled server to read arbitrary files from the data-dts host.
References
- https://github.com/alldatacenter/alldata
- https://github.com/alldatacenter/alldata/blob/alldata-release-0.7.1/moat/studio/data-dts/service-data-dts/src/main/java/com/platform/admin/config/WebSecurityConfiguration.java
- https://github.com/alldatacenter/alldata/blob/alldata-release-0.7.1/moat/studio/data-dts/service-data-dts/src/main/java/com/platform/admin/controller/JobDatasourceController.java#L131-L135
- https://github.com/alldatacenter/alldata/blob/alldata-release-0.7.1/moat/studio/data-dts/service-data-dts/src/main/java/com/platform/admin/tool/query/BaseQueryTool.java#L107-L124
- https://hackmd.io/@hieuPenguinnn/alldata-dts-unauthenticated-jdbc-url-injection
- https://www.vulncheck.com/advisories/alldata-through-0.7.1-unauthenticated-jdbc-injection-via-jobjdbcdatasource-test