CVE-2026-70559

Received Received - Intake

Information Disclosure in Dinky Framework

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: VulnCheck

Description

Dinky's SysConfigController.getAll() handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaCheckLogin, so the Sa-Token interceptor lets the request through with no session or role check. Any remote unauthenticated caller who can reach the Dinky HTTP port (8888 by default) receives the full live system configuration (54 entries on a stock v1.2.5 install) with one parameterless GET. Only one credential field (sys.maven.settings.repositoryPassword) has a desensitization handler wired; the other credential-bearing fields (sys.env.settings.dinkyToken, sys.ldap.settings.userPassword, sys.resource.settings.oss.accessKey and secretKey, and sys.dolphinscheduler.settings.token) return in cleartext. A bare install leaks the shipped defaults, including the hardcoded dinkyToken efda1551-7958-4e0f-80a8-dfd107df3e38 and minioadmin/minioadmin OSS keys; once an operator configures LDAP, object storage, or DolphinScheduler through the Settings Center, those live third-party credentials leak from the same endpoint. Because dinkyToken is the sole gate on the sibling POST /download/uploadFromRsByLocal arbitrary file write, this disclosure defeats token rotation as a mitigation for that vulnerability. Affects Dinky v1.2.5 (the current release, 2025-11-05) and the development branch (dev HEAD 63b5a5a), where the affected code is byte-identical.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-70559

Affected Vendors & Products

Vendor	Product	Version / Range
dinky	sysconfigcontroller	1.2.5
dinky	sysconfigcontroller	dev_head

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability is an authentication bypass in Dinky's SysConfigController.getAll() endpoint. The method has an @SaIgnore annotation that overrides the class-level @SaCheckLogin, allowing unauthenticated remote access to the system configuration. The endpoint leaks sensitive credentials in cleartext, including hardcoded tokens and third-party service keys.

Detection Guidance

Check if the Dinky HTTP port (default 8888) is exposed to the network. Send a GET request to /api/sysConfig/getAll and inspect the response for sensitive data like credentials or configuration details. Example: curl -v http://<target-ip>:8888/api/sysConfig/getAll

Impact Analysis

Unauthenticated attackers can access the full system configuration, including hardcoded credentials like dinkyToken and MinIO access keys. This enables further attacks such as arbitrary file writes via the POST /download/uploadFromRsByLocal endpoint, as the dinkyToken is the sole authorization mechanism for that endpoint.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access controls. It exposes sensitive credentials and system configurations, which could lead to unauthorized access to personal or health data, violating GDPR and HIPAA privacy and security rules.

Mitigation Strategies

Immediately restrict access to the Dinky HTTP port (8888) using firewalls or network policies. Update to a patched version if available. Rotate all exposed credentials, especially dinkyToken and third-party service keys. Disable the affected endpoint if no patch is available.

Hi! I’m here to help you understand CVE-2026-70559. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70