CVE-2026-122009

Overview

DataLinkDC Dinky versions up to 1.2.5 contain a Server-Side Request Forgery (SSRF) vulnerability in the FlinkWebURITemplateProxyServlet component. This flaw allows remote attackers to manipulate the _authority argument to force the server to make requests to unintended internal or external targets. The vulnerability is critical for environments where Dinky acts as a proxy for Flink web interfaces.

Description

A flaw has been found in DataLinkDC Dinky up to 1.2.5. This vulnerability affects the function FlinkWebURITemplateProxyServlet.getNewTargetUri of the file dinky-admin/src/main/java/org/dinky/utils/FlinkWebURITemplateProxyServlet.java of the component flink_web Proxy Endpoint. This manipulation of the argument _authority causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The researcher claims to have submitted a GHSA on the repository of the project.

Impact

Confidentiality and Integrity are compromised as attackers can probe internal network services or access sensitive metadata endpoints. Availability may be affected if internal services are overwhelmed or misconfigured via forged requests. Primary impact is on organizations deploying Dinky in multi-tenant or cloud environments where internal network segmentation is relied upon for security. Defenders should assume potential lateral movement or data exfiltration if the service is exposed to untrusted networks.

Remediation

Upgrade DataLinkDC Dinky to a version later than 1.2.5 where the SSRF flaw is patched. If immediate upgrade is not possible, restrict network access to the Dinky service to trusted internal networks only using firewalls or security groups. Implement strict input validation and allowlisting for the _authority parameter at the reverse proxy or application gateway level. Monitor logs for anomalous outbound requests originating from the Dinky service to detect active exploitation attempts.

Risk context

The vulnerability is rated High with a CVSS v3 score of 7.3. Although no EPSS score is currently available, the public disclosure of the exploit and the remote attack vector increase the urgency for patching. Defenders should prioritize remediation for any internet-facing or semi-trusted network instances of Dinky.

Affected products

• DataLinkDC Dinky <= 1.2.5