CVE-2026-111613: AllData through 0.7.1 Unauthenticated JDBC Injection via /jobJdbcDatasource/test

Q: Which deployments are exposed?

AllData deployments through version 0.7.1 are affected if the data-dts /jobJdbcDatasource/test endpoint is reachable by a remote attacker. The endpoint is described as unauthenticated, so no account or prior access is required.

Q: What does an attacker need to exploit this?

An attacker only needs network access to the /jobJdbcDatasource/test endpoint and can provide jdbcUrl and jdbcDriverClass values. A MySQL JDBC URL with allowLoadLocalInfile=true can be used to point at an attacker-controlled server.

Q: What is the practical impact of exploitation?

The flaw lets an attacker cause the data-dts host to open arbitrary database connections. In the stated MySQL scenario, it can allow reading arbitrary files from the data-dts host.

Q: What can be done if patching is not immediately possible?

Restrict remote access to the data-dts /jobJdbcDatasource/test endpoint so untrusted users cannot reach it. Because exploitation is unauthenticated, network-level access control is particularly important.

Published Oct 16, 2026

Updated

AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with allowLoadLocalInfile=true pointing to an attacker-controlled server to read arbitrary files from the data-dts host.

Affected Software

1 affected component

Alldata Alldata<=0.7.1

Event History

Oct 16, 2026

CVE Published

via MITRE·05:38 PM

Data Sourced

via MITRE·05:38 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

AllData deployments through version 0.7.1 are affected if the data-dts /jobJdbcDatasource/test endpoint is reachable by a remote attacker. The endpoint is described as unauthenticated, so no account or prior access is required.

What does an attacker need to exploit this?

An attacker only needs network access to the /jobJdbcDatasource/test endpoint and can provide jdbcUrl and jdbcDriverClass values. A MySQL JDBC URL with allowLoadLocalInfile=true can be used to point at an attacker-controlled server.

What is the practical impact of exploitation?

The flaw lets an attacker cause the data-dts host to open arbitrary database connections. In the stated MySQL scenario, it can allow reading arbitrary files from the data-dts host.

What can be done if patching is not immediately possible?

Restrict remote access to the data-dts /jobJdbcDatasource/test endpoint so untrusted users cannot reach it. Because exploitation is unauthenticated, network-level access control is particularly important.

CVE-2026-111613: AllData through 0.7.1 Unauthenticated JDBC Injection via /jobJdbcDatasource/test

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this?

What is the practical impact of exploitation?

What can be done if patching is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this?

What is the practical impact of exploitation?

What can be done if patching is not immediately possible?