CVE-2026-122009: DataLinkDC Dinky flink_web Proxy Endpoint FlinkWebURITemplateProxyServlet.java FlinkWebURITemplateProxyServlet.getNewTargetUri server-side request forgery
A flaw has been found in DataLinkDC Dinky up to 1.2.5. This vulnerability affects the function FlinkWebURITemplateProxyServlet.getNewTargetUri of the file dinky-admin/src/main/java/org/dinky/utils/FlinkWebURITemplateProxyServlet.java of the component flinkweb Proxy Endpoint. This manipulation of the argument authority causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The researcher claims to have submitted a GHSA on the repository of the project.
Event History
Frequently Asked Questions
Which deployments are affected?
DataLinkDC Dinky versions up to and including 1.2.5 are identified as affected, specifically the flink_web Proxy Endpoint implementation in FlinkWebURITemplateProxyServlet.java.
What does an attacker need to exploit this issue?
The attack can be initiated remotely and does not require privileges or user interaction according to the supplied severity vector. Exploitation involves manipulating the _authority argument handled by FlinkWebURITemplateProxyServlet.getNewTargetUri.
Is public exploitation a concern?
Yes. An exploit has been published and may be used, so exposed affected instances should be treated as having practical exploitation risk.