Summary
CVE-2026-70559 is a missing-authentication vulnerability (CWE-306) in DataLinkDC Dinky, a real-time data development platform based on Apache Flink. An unauthenticated remote attacker can retrieve the complete system configuration — including cleartext credentials — through an exposed API endpoint. The issue is rated High severity (CVSS v3.1 base score 7.5).
Technical details
- Root cause: The
GET /api/sysConfig/getAllendpoint carries a method-level@SaIgnoreannotation that overrides the class-level login check, so the request is served without any session or role validation. - Trigger conditions: A single parameterless, unauthenticated HTTP GET request to the endpoint on a reachable Dinky instance.
- Attack vector: Network — no privileges and no user interaction required.
- Impact: Disclosure of the full live system configuration. Multiple credential fields are returned in cleartext, including
sys.env.settings.dinkyToken,sys.ldap.settings.userPassword,sys.resource.settings.oss.accessKey,sys.resource.settings.oss.secretKey, andsys.dolphinscheduler.settings.token. Exposed secrets can enable access to connected LDAP, object-storage, and scheduling systems.
Affected software
- DataLinkDC Dinky: all versions from 0 through 1.2.5.
Severity
- CVSS v3.1 base score: 7.5 (High) —
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - The CVE record also lists a CVSS v4.0 score of 8.7 (High) —
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Mitigation and recommended actions
- Immediate: No fixed version is identified in the CVE record or vendor advisory at time of writing. Monitor the DataLinkDC Dinky GitHub advisory (GHSA-c48m-x2xw-32rj) and releases page, and upgrade as soon as a patched release is published.
- If no patch: Restrict network access to the Dinky management interface so it is not reachable from untrusted networks; place it behind an authenticating reverse proxy or VPN and enforce IP allow-listing. Rotate any credentials that may have been exposed via the endpoint (tokens, LDAP passwords, object-storage keys, and scheduler tokens).

