CVE-2026-124558
DataLinkDC Dinky sql-gateway Endpoint SqlGateway.java SqlGateway.onOpen server-side request forgery
CVSS Score
7.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability has been found in DataLinkDC Dinky up to 1.2.5. The impacted element is the function SqlGateway.onOpen of the file SqlGateway.java of the component sql-gateway Endpoint. Such manipulation of the argument connectAddress leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The researcher claims to have submitted a GHSA on the repository of the project.
| CWE | CWE-918 |
| Vendor | datalinkdc |
| Product | dinky |
| Published | Nov 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for datalinkdc dinky
Be the first to know when new high vulnerabilities affecting datalinkdc dinky are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
DataLinkDC / Dinky
1.2.0 1.2.1 1.2.2 1.2.3 1.2.4 1.2.5
References
vuldb.com: https://vuldb.com/vuln/432891 vuldb.com: https://vuldb.com/vuln/432891/cti vuldb.com: https://vuldb.com/cve/CVE-2026-124558 vuldb.com: https://vuldb.com/submit/1035494 github.com: https://github.com/DataLinkDC/dinky/security/advisories/GHSA-x4hx-f425-mrx6 github.com: https://github.com/DataLinkDC/dinky/
Credits
🔍 lucasg2g (VulDB User) VulDB CNA Team