CVE-2026-124558 | DataLinkDC Dinky up to 1.2.5 sql-gateway Endpoint SqlGateway.java SqlGateway.onOpen connectAddress server-side request forgery (GHSA-x4hx-f425-mrx6)

SecurityVulns
Yanac

A vulnerability labeled as critical has been found in DataLinkDC Dinky up to 1.2.5. The impacted element is the function SqlGateway.onOpen of the file SqlGateway.java of the component sql-gateway Endpoint. Such manipulation of the argument connectAddress leads to server-side request forgery.

This vulnerability is referenced as CVE-2026-124558. It is possible to launch the attack remotely. Furthermore, an exploit is available.

The researcher claims to have submitted a GHSA on the repository of the project.VulDB Recent EntriesRead More