CVE-2026-70559 Details
Description
Dinky's SysConfigController.getAll() handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaCheckLogin, so the Sa-Token interceptor lets the request through with no session or role check. Any remote unauthenticated caller who can reach the Dinky HTTP port (8888 by default) receives the full live system configuration (54 entries on a stock v1.2.5 install) with one parameterless GET. Only one credential field (sys.maven.settings.repositoryPassword) has a desensitization handler wired; the other credential-bearing fields (sys.env.settings.dinkyToken, sys.ldap.settings.userPassword, sys.resource.settings.oss.accessKey and secretKey, and sys.dolphinscheduler.settings.token) return in cleartext. A bare install leaks the shipped defaults, including the hardcoded dinkyToken efda1551-7958-4e0f-80a8-dfd107df3e38 and minioadmin/minioadmin OSS keys; once an operator configures LDAP, object storage, or DolphinScheduler through the Settings Center, those live third-party credentials leak from the same endpoint. Because dinkyToken is the sole gate on the sibling POST /download/uploadFromRsByLocal arbitrary file write, this disclosure defeats token rotation as a mitigation for that vulnerability. Affects Dinky v1.2.5 (the current release, 2025-11-05) and the development branch (dev HEAD 63b5a5a), where the affected code is byte-identical.
A vulnerability in Dinky's SysConfigController has been identified, specifically in the GET /api/sysConfig/getAll endpoint. The issue arises from a method-level @SaIgnore annotation that bypasses the class-level @SaCheckLogin, allowing remote unauthenticated callers to access the full system configuration. This vulnerability affects Dinky version 1.2.5 and the development branch (dev HEAD 63b5a5a). The exposed configuration includes sensitive credential-bearing fields, with only one field having a masking handler, while the others are returned in cleartext. This issue not only discloses default credentials but also leaks live third-party credentials once certain integrations are configured, undermining the application's security measures.
As of now, there is no fixed version available. However, it is recommended to remove the @SaIgnore annotation from the SysConfigController.getAll() method and to attach a desensitizedHandler to all credential fields in the SystemConfiguration class to ensure they are masked in the response. Until this vulnerability is addressed, Dinky users should not expose the application port to untrusted networks and should rotate any credentials that were entered into the Settings Center.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 6, 2026CISA-ADP
Assessed Aug 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/DataLinkDC/dinky | [email protected] | ProductVendor |
| https://github.com/DataLinkDC/dinky/issues/4567 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/DataLinkDC/dinky/security/advisories/GHSA-c48m-x2xw-32rj | [email protected] | AdvisoryBroken LinkVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Dinky | 1.2.5 (semver) dev HEAD 63b5a5a |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 7, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2026 | New CVE Received | [email protected] |