CVE-2026-70559: Dinky Unauthenticated System Configuration and Credential Disclosure via GET /api/sysConfig/getAll
Dinky's SysConfigController.getAll() handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaCheckLogin, so the Sa-Token interceptor lets the request through with no session or role check. Any remote unauthenticated caller who can reach the Dinky HTTP port (8888 by default) receives the full live system configuration (54 entries on a stock v1.2.5 install) with one parameterless GET. Only one credential field (sys.maven.settings.repositoryPassword) has a desensitization handler wired; the other credential-bearing fields (sys.env.settings.dinkyToken, sys.ldap.settings.userPassword, sys.resource.settings.oss.accessKey and secretKey, and sys.dolphinscheduler.settings.token) return in cleartext. A bare install leaks the shipped defaults, including the hardcoded dinkyToken efda1551-7958-4e0f-80a8-dfd107df3e38 and minioadmin/minioadmin OSS keys; once an operator configures LDAP, object storage, or DolphinScheduler through the Settings Center, those live third-party credentials leak from the same endpoint. Because dinkyToken is the sole gate on the sibling POST /download/uploadFromRsByLocal arbitrary file write, this disclosure defeats token rotation as a mitigation for that vulnerability. Affects Dinky v1.2.5 (the current release, 2025-11-05) and the development branch (dev HEAD 63b5a5a), where the affected code is byte-identical.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify SysConfigController.getAll() to remove the method-level @SaIgnore annotation on the handler for GET /api/sysConfig/getAll, ensuring the class-level @SaCheckLogin requirement applies (no unauthenticated access to live system configuration).
Dinky SysConfigController / API endpoint GET /api/sysConfig/getAll @SaIgnore (method-level annotation) = Remove/disable method-level @SaIgnore so that class-level @SaCheckLogin is enforced - Configuration
Ensure GET /api/sysConfig/getAll does not return credential-bearing fields in cleartext. At minimum, obfuscate these fields: sys.env.settings.dinkyToken, sys.ldap.settings.userPassword, sys.resource.settings.oss.accessKey and secretKey, and sys.dolphinscheduler.settings.token. (Only sys.maven.settings.repositoryPassword is stated as currently desensitized.)
Dinky sysconfig desensitization Cleartext exposure of credential fields = Desensitize/obfuscate in responses - Compensating control
Restrict network access to the Dinky HTTP port (8888 by default) so unauthenticated callers cannot reach the endpoint that returns full system configuration (GET /api/sysConfig/getAll). Use firewall/ACL/network isolation to limit access to trusted IPs/administrators only.
- Operational
Rotate/re-generate exposed credentials after patching, because dinkyToken (and other listed credential fields) leak via GET /api/sysConfig/getAll. Specifically, rotate sys.env.settings.dinkyToken and the other credential-bearing values returned in cleartext: sys.ldap.settings.userPassword, sys.resource.settings.oss.accessKey and secretKey, and sys.dolphinscheduler.settings.token.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70559?
CVE-2026-70559 has a high severity rating of 7.5 based on its impact on confidentiality.
How do I fix CVE-2026-70559?
To fix CVE-2026-70559, ensure that appropriate authentication checks are implemented for the GET /api/sysConfig/getAll endpoint.
What does CVE-2026-70559 affect?
CVE-2026-70559 affects the Dinky software, specifically the SysConfigController component.
What type of vulnerability is CVE-2026-70559?
CVE-2026-70559 is an unauthenticated system configuration and credential disclosure vulnerability.
Who is at risk due to CVE-2026-70559?
Any remote unauthenticated user can exploit CVE-2026-70559 to access sensitive configuration and credential information.