CVE-2026-111693: DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials
DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator token and access all protected /webapi routes.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker only needs network access to the ai-apm-web login endpoint at /webapi/api/v1/auth/login. No existing account, privileges, or user interaction is required because the built-in admin/Databuff@123 credentials can be used to obtain an administrator token.
Which deployments are affected?
DataBuff ai-apm-web through version 0.1.10 is affected. Deployments exposing the web API to untrusted network users are directly reachable by unauthenticated attackers.
How can I determine whether a deployment has been compromised?
Review authentication and application logs for successful POST requests to /webapi/api/v1/auth/login using the built-in administrator account, and investigate administrator tokens issued from those logins. Also review access to protected /webapi routes associated with those tokens.
What can be done if patching is not immediately possible?
Restrict network access to /webapi/api/v1/auth/login and other /webapi endpoints to trusted administrators or internal networks. Treat the built-in administrator credentials as exposed and investigate any use of the account.