CVE-2026-111696: data-platform-open through commit efeacd3 Hardcoded AES Key for Datasource Passwords
data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via cross-workspace IDOR, and decrypt them offline to recover plaintext database credentials.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated account and access to datasource password ciphertexts. The described path includes obtaining those values from the datasource detail API, such as through a cross-workspace IDOR.
Does this affect the default configuration?
Yes. The affected code uses a hardcoded, publicly known default AES key for datasource password encryption and decryption.
What can an attacker recover after obtaining the ciphertext?
They can decrypt the ciphertext offline to recover plaintext database credentials. The stated impact is confidentiality exposure; integrity and availability are not affected.
How can I determine whether my deployment is affected?
Check whether the deployment is data-platform-open at or before commit efeacd3 and whether AesPasswordEncAndDecServiceImpl uses the hardcoded default AES key. Also review whether authenticated users can retrieve datasource details outside their authorized workspace.