CVE-2026-122009 | DataLinkDC Dinky up to 1.2.5 flink_web Proxy Endpoint FlinkWebURITemplateProxyServlet.java FlinkWebURITemplateProxyServlet.getNewTargetUri _authority server-side request forgery (GHSA-wchp-mjj9-wxqh)

November 4, 2026 Yanac

A vulnerability marked as critical has been reported in DataLinkDC Dinky up to 1.2.5. This vulnerability affects the function FlinkWebURITemplateProxyServlet.getNewTargetUri of the file dinky-admin/src/main/java/org/dinky/utils/FlinkWebURITemplateProxyServlet.java of the component flink_web Proxy Endpoint. This manipulation of the argument _authority causes server-side request forgery.

This vulnerability is handled as CVE-2026-122009. The attack can be initiated remotely. Additionally, an exploit exists.

The researcher claims to have submitted a GHSA on the repository of the project.VulDB Recent EntriesRead More