CVE-2026-111696
Received Received - Intake

Hardcoded AES Key in data-platform-open Exposes Database Credentials

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via cross-workspace IDOR, and decrypt them offline to recover plaintext database credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111696
EUVD
EUVD-2026-102987

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
shaiwz data-platform-open 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-321 The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a hardcoded default AES key in the data-platform-open software. Attackers with authentication can exploit this to decrypt stored datasource passwords. They can retrieve encrypted passwords via APIs like cross-workspace IDOR and decrypt them offline to obtain plaintext database credentials.

Detection Guidance

Check for hardcoded AES keys in AesPasswordEncAndDecServiceImpl. Inspect datasource detail API responses for ciphertext passwords. Look for cross-workspace IDOR vulnerabilities that could expose these ciphertexts.

Impact Analysis

An attacker could gain access to sensitive database credentials, leading to unauthorized access to databases, data breaches, or further network compromise. This could result in data theft, manipulation, or disruption of services.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection standards like GDPR and HIPAA, which mandate strong encryption and protection of sensitive data. A breach could lead to legal penalties, fines, and reputational damage.

Mitigation Strategies

Rotate the hardcoded AES key immediately. Update data-platform-open to a version without hardcoded keys. Restrict access to datasource detail API endpoints. Audit all stored datasource passwords for potential exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111696. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart