Unauthenticated JDBC injection in AllData exposes host files
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
AllData through 0.7.1 contains an unauthenticated JDBC injection flaw, tracked as CWE-306, in the data-dts /jobJdbcDatasource/test endpoint. A remote attacker without credentials can open arbitrary database connections by supplying a crafted jdbcUrl and jdbcDriverClass. A MySQL URL with allowLoadLocalInfile=true pointing to an attacker-controlled server lets the attacker read arbitrary files from the data-dts host.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with allowLoadLocalInfile=true pointing to an attacker-controlled server to read arbitrary files from the data-dts host.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| alldatacenter | alldata | up to 0.7.1 | — | No fix listed | CNA |
- alldata Vendoralldatacenter Affected up to 0.7.1 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for AllData.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-16 Threatist record created from CVE-2026-111613
- 2026-10-16 Alias added: GHSA-33v5-488r-m83x
- 2026-10-18 Priority changed: MEDIUM → LOW
- 2026-10-23 CISA SSVC decision points changed
- 2026-10-23 Priority changed: LOW → HIGH
References
Other 4
- https://github.com/alldatacenter/alldata/blob/alldata-release-0.7.1/moat/studio/data-dts/service-data-dts/src/main/java/com/platform/admin/tool/query/BaseQueryTool.java#L107-L124
- https://github.com/alldatacenter/alldata/blob/alldata-release-0.7.1/moat/studio/data-dts/service-data-dts/src/main/java/com/platform/admin/config/WebSecurityConfiguration.java
- https://github.com/alldatacenter/alldata/blob/alldata-release-0.7.1/moat/studio/data-dts/service-data-dts/src/main/java/com/platform/admin/controller/JobDatasourceController.java#L131-L135
- https://github.com/alldatacenter/alldata
More alldatacenter vulnerabilities
- TI-2026-16078 alldatacenter alldata logDetailCat Endpoint JobLogController.java FileInputStream path traversal CVSS 4.0MEDIUM 6.9
- TI-2026-16077 alldatacenter alldata xxl-rpc Listener HessianSerializer.java Hessian2Input.readObject deserialization CVSS 4.0MEDIUM 6.9
Sources
- CVE-2026-111613 · CVE Program
- CVE-2026-111613 · NVD
- FIRST EPSS
- GHSA-33v5-488r-m83x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences