Authentication Bypass in Dinky SysConfigController

Dinky v1.2.5 and development branch builds contain an authentication bypass vulnerability (CVE-2026-70559) within the SysConfigController.getAll handler. The vulnerability stems from a method-level @SaIgnore annotation that overrides the class-level @SaCheckLogin, effectively disabling the Sa-Token interceptor for the /api/sysConfig/getAll endpoint. Consequently, any remote unauthenticated caller with network access to the Dinky HTTP port (default 8888) can trigger a parameterless GET request to retrieve the full live system configuration.

The leaked configuration data contains sensitive cleartext credentials, including LDAP passwords, OSS access/secret keys, DolphinScheduler tokens, and the internal Dinky service token. This exposure is particularly critical as it reveals the dinkyToken, which is the primary authentication gate for the /download/uploadFromRsByLocal endpoint, facilitating downstream arbitrary file write attacks. The issue affects the v1.2.5 release and the current development head (63b5a5a).

Impact

Successful exploitation allows unauthenticated attackers to harvest highly sensitive third-party integration credentials and administrative service tokens. Access to these credentials facilitates deeper lateral movement within the environment and persistent access to backend services such as LDAP servers, Object Storage, and job scheduling platforms. Furthermore, the leakage of the internal dinkyToken directly enables exploitation of arbitrary file write vulnerabilities, leading to potential remote code execution on the Dinky server.

Recommendation

• Restrict network access to the Dinky HTTP port (8888) to trusted IP ranges only via host-based or network firewalls to prevent unauthorized access to /api/sysConfig/getAll.
• Audit all third-party credentials (LDAP, OSS, DolphinScheduler) that were stored in the Dinky Settings Center, as these are considered compromised.
• Implement monitoring on the /api/sysConfig/getAll endpoint to detect unauthorized GET requests from non-admin internal segments.
• Review and rotate the dinkyToken immediately if the Dinky instance is network-accessible.