PT-2026-21638 · Unknown · Datalinkdc Dinky

Ana10Gy · Publicado 2026-02-24 · Atualizado 2026-02-24 · CVE-2026-3052

Positive Technologies (AI Summary)

CVSS v3.1

7.7

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions DataLinkDC dinky versions up to 1.2.5

Description A server-side request forgery condition exists in DataLinkDC dinky. The issue is located in the proxyUba function within the dinky-admin/src/main/java/org/dinky/controller/FlinkProxyController.java file of the Flink Proxy Controller component. Manipulation of a request can lead to server-side request forgery. This issue is remotely exploitable, and details about the exploit have been publicly released. The vendor was notified but did not respond.

Recommendations Versions prior to 1.2.5 are affected. As a temporary workaround, consider disabling the proxyUba() function until a patch is available. Restrict access to the Flink Proxy Controller module to minimize the risk of exploitation.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-3052

Produtos afetados

Datalinkdc Dinky

Referências · 10

• 🔥 https://github.com/AnalogyC0de/public_exp/issues/7#issue-3935032160 · Exploit
• 🔥 https://github.com/AnalogyC0de/public_exp/issues/7 · Exploit
• https://vuldb.com/?id.347410 · Nota
• https://vuldb.com/?ctiid.347410 · Nota
• https://twitter.com/CVEnew/status/2026184633227108860 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2026130812865839311 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-3052 · Aviso do Fabricante
• https://vuldb.com/?submit.757587 · Nota
• https://t.me/CVEtracker/45550 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-3052 · Nota de Segurança