CVE-2026-3052

Katalog CVE

CVSS 7.7 · High EPSS 0,41%

Kerentanan Server-Side Request Forgery (SSRF) pada dinky. Skor CVSS 3.1 7.7 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability was found in DataLinkDC dinky up to 1.2.5. The impacted element is the function proxyUba of the file dinky-admin/src/main/java/org/dinky/controller/FlinkProxyController.java of the component Flink Proxy Controller. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Rincian

Terbit di NVD

24 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.7 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 32,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/AnalogyC0de/public_exp/issues/7 exploit · issue tracking · advisory pihak ketiga
• https://github.com/AnalogyC0de/public_exp/issues/7#issue-3935032160 exploit · issue tracking · advisory pihak ketiga
• https://vuldb.com/?ctiid.347410 permissions required · advisory pihak ketiga · vdb entry
• https://vuldb.com/?id.347410 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.757587 advisory pihak ketiga · vdb entry