Dinky (<= 1.2.5) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/dinky--1.2.5/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 05 Nov 2026 00:06:06 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDataLinkDC Dinky: Server-side request forgery (CVE-2026-122009)https://feed.craftedsignal.io/briefs/2026-11-dinky-ssrf/Thu, 05 Nov 2026 00:06:06 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-dinky-ssrf/A server-side request forgery vulnerability in DataLinkDC Dinky (<= 1.2.5) allows remote attackers to manipulate the _authority argument to trigger unauthorized requests from the server.A vulnerability has been identified in DataLinkDC Dinky versions up to 1.2.5 affecting the FlinkWebURITemplateProxyServlet.getNewTargetUri function within the flink_web Proxy Endpoint. An attacker can exploit this via the _authority argument to achieve server-side request forgery (SSRF). The exploit has been publicly disclosed and may be actively targeted.

Impact

The SSRF vulnerability allows an unauthenticated remote attacker to force the Dinky server to perform unauthorized HTTP requests. This could lead to information disclosure from internal network resources or interaction with unauthorized internal services.

Recommendation

  • Inventory all instances of Dinky to identify versions 1.2.5 or earlier.
  • Monitor network logs for unusual outbound requests originating from the Dinky application server, specifically requests directed toward internal IP ranges or restricted local services.
  • Apply security patches or updates provided by the vendor once available for the affected versions.
]]>highadvisory