CVE-2026-3053 Details

A critical authentication bypass vulnerability has been identified in DataLinkDC Dinky versions through 1.2.5. This issue arises from a logic flaw in the authentication interceptor for OpenAPI endpoints, specifically in the 'addInterceptors' function of 'AppConfig.java'. The vulnerability allows unauthenticated users to gain Super Admin privileges, enabling them to execute arbitrary tasks, cancel production jobs, access sensitive SQL source code, and utilize all administrative functions. The vulnerability can be exploited remotely, and a public exploit is available.

The vulnerability can be addressed by removing the automatic elevation of privileges for unauthenticated users. This can be done by modifying the interceptor configuration to either remove the exception for OpenAPI endpoints or explicitly reject unauthenticated requests. If public API access is intended, additional measures such as implementing API token authentication, adding method-level authorization, and enhancing network security can be considered.