CVE-2026-124558: DataLinkDC Dinky sql-gateway Endpoint SqlGateway.java SqlGateway.onOpen server-side request forgery
A vulnerability has been found in DataLinkDC Dinky up to 1.2.5. The impacted element is the function SqlGateway.onOpen of the file SqlGateway.java of the component sql-gateway Endpoint. Such manipulation of the argument connectAddress leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The researcher claims to have submitted a GHSA on the repository of the project.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
DataLinkDC Dinky versions up to 1.2.5 are identified as affected. The vulnerable component is the sql-gateway endpoint, specifically SqlGateway.onOpen in SqlGateway.java.
What does an attacker need to exploit this issue?
The attack can be launched remotely by manipulating the connectAddress argument. The supplied severity vector indicates no privileges or user interaction are required.
Is exploit information publicly available?
Yes. The exploit has been publicly disclosed and may be used. The researcher also claims to have submitted a GHSA to the project repository.