high advisory November 5, 2026

DataLinkDC Dinky: Server-side request forgery (CVE-2026-122009)

A server-side request forgery vulnerability in DataLinkDC Dinky (<= 1.2.5) allows remote attackers to manipulate the _authority argument to trigger unauthorized requests from the server.

Triage facts

Revision 1

Applicability: Dinky (<= 1.2.5)
Evidence: Unknown
Severity: High
Action: Elevated
Sources: 1 public source
Freshness: Revision 1Nov 5, 00:06 UTC
Vulnerabilities: 1 CVE
Source quality: A1Likely

A vulnerability has been identified in DataLinkDC Dinky versions up to 1.2.5 affecting the FlinkWebURITemplateProxyServlet.getNewTargetUri function within the flink_web Proxy Endpoint. An attacker can exploit this via the _authority argument to achieve server-side request forgery (SSRF). The exploit has been publicly disclosed and may be actively targeted.

Impact

The SSRF vulnerability allows an unauthenticated remote attacker to force the Dinky server to perform unauthorized HTTP requests. This could lead to information disclosure from internal network resources or interaction with unauthorized internal services.

Recommendation

Inventory all instances of Dinky to identify versions 1.2.5 or earlier.
Monitor network logs for unusual outbound requests originating from the Dinky application server, specifically requests directed toward internal IP ranges or restricted local services.
Apply security patches or updates provided by the vendor once available for the affected versions.

Immediate actions

Inventory Dinky instances running version 1.2.5 or earlier

IT Operations 24h

Threat Hunt

Identify unusual outbound HTTP requests initiated by the Dinky server process

T1190 high medium confidence hunt now

Data: Proxy logs, Firewall logs, Flow logs

Mitigations

Restrict network access for the Dinky server to only necessary external services

immediate IT Operations

CVE-2026-122009