{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3adatalinkdcdinky/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:datalinkdc:dinky:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-122009"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Dinky (\u003c= 1.2.5)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["DataLinkDC"],"content_html":"\u003cp\u003eA vulnerability has been identified in DataLinkDC Dinky versions up to 1.2.5 affecting the FlinkWebURITemplateProxyServlet.getNewTargetUri function within the flink_web Proxy Endpoint. An attacker can exploit this via the _authority argument to achieve server-side request forgery (SSRF). The exploit has been publicly disclosed and may be actively targeted.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe SSRF vulnerability allows an unauthenticated remote attacker to force the Dinky server to perform unauthorized HTTP requests. This could lead to information disclosure from internal network resources or interaction with unauthorized internal services.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all instances of Dinky to identify versions 1.2.5 or earlier.\u003c/li\u003e\n\u003cli\u003eMonitor network logs for unusual outbound requests originating from the Dinky application server, specifically requests directed toward internal IP ranges or restricted local services.\u003c/li\u003e\n\u003cli\u003eApply security patches or updates provided by the vendor once available for the affected versions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T00:06:06Z","date_published":"2026-11-05T00:06:06Z","id":"https://feed.craftedsignal.io/briefs/2026-11-dinky-ssrf/","summary":"A server-side request forgery vulnerability in DataLinkDC Dinky (\u003c= 1.2.5) allows remote attackers to manipulate the _authority argument to trigger unauthorized requests from the server.","title":"DataLinkDC Dinky: Server-side request forgery (CVE-2026-122009)","url":"https://feed.craftedsignal.io/briefs/2026-11-dinky-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:datalinkdc:dinky:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}