Vulnerability · Published Oct 16, 2026 · Assigned by VulnCheck
CVE-2026-111613AllData through 0.7.1 Unauthenticated JDBC Injection via /jobJdbcDatasource/test
High 7.5
In plain English
A high-severity missing authentication in alldata from alldatacenter. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Official description
AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with allowLoadLocalInfile=true pointing to an attacker-controlled server to read arbitrary files from the data-dts host.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| alldatacenter | alldata | 0 – through 0.7.1 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://hackmd.io/@hieuPenguinnn/alldata-dts-unauthenticated-jdbc-url-injection third-party-advisory
- https://github.com/alldatacenter/alldata/blob/alldata-release-0.7.1/moat/studio/data-dts/service-data-dts/src/main/java/com/platform/admin/tool/query/BaseQueryTool.java#L107-L124 technical-description
- https://github.com/alldatacenter/alldata/blob/alldata-release-0.7.1/moat/studio/data-dts/service-data-dts/src/main/java/com/platform/admin/config/WebSecurityConfiguration.java technical-description
- https://github.com/alldatacenter/alldata/blob/alldata-release-0.7.1/moat/studio/data-dts/service-data-dts/src/main/java/com/platform/admin/controller/JobDatasourceController.java#L131-L135 technical-description
- https://github.com/alldatacenter/alldata product
- VulnCheck Advisory: AllData through 0.7.1 Unauthenticated JDBC Injection via /jobJdbcDatasource/test third-party-advisory