CVE-2026-122009

HIGH 7.3

DataLinkDC Dinky flink_web Proxy Endpoint FlinkWebURITemplateProxyServlet.java FlinkWebURITemplateProxyServlet.getNewTargetUri server-side request forgery

CVSS Score

7.3

EPSS Score

0.0%

EPSS Percentile

0th

A flaw has been found in DataLinkDC Dinky up to 1.2.5. This vulnerability affects the function FlinkWebURITemplateProxyServlet.getNewTargetUri of the file dinky-admin/src/main/java/org/dinky/utils/FlinkWebURITemplateProxyServlet.java of the component flink_web Proxy Endpoint. This manipulation of the argument _authority causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The researcher claims to have submitted a GHSA on the repository of the project.

CWE	CWE-918
Vendor	datalinkdc
Product	dinky
Published	Nov 4, 2026

Stay Ahead of the Next One

Get instant alerts for datalinkdc dinky

Be the first to know when new high vulnerabilities affecting datalinkdc dinky are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

DataLinkDC / Dinky

1.2.0 1.2.1 1.2.2 1.2.3 1.2.4 1.2.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/431072 vuldb.com: https://vuldb.com/vuln/431072/cti vuldb.com: https://vuldb.com/cve/CVE-2026-122009 vuldb.com: https://vuldb.com/submit/1015959 github.com: https://github.com/DataLinkDC/dinky/security/advisories/GHSA-wchp-mjj9-wxqh github.com: https://github.com/DataLinkDC/dinky/

Credits

🔍 lucasg2g (VulDB User) VulDB CNA Team