AllData: Unauthenticated JDBC injection in data-dts service

Summary

AllData through version 0.7.1 contains an unauthenticated JDBC injection flaw in the data-dts service, reachable via the /jobJdbcDatasource/test endpoint. A remote attacker can supply jdbcUrl and jdbcDriverClass values to open arbitrary database connections. Using a MySQL JDBC URL with allowLoadLocalInfile=true pointing to an attacker-controlled server, the attacker may read arbitrary files from the data-dts host. No authentication or user interaction is required, but the service must be reachable over the network.

Affected

• AllData through 0.7.1 (alldatacenter/alldata)
• Affected component: data-dts service, /jobJdbcDatasource/test endpoint
• Unknown whether other versions or builds are affected beyond the CNA range

Fixed in

• Unknown. No fixed release or patch found in the sources reviewed.

Workaround

• No vendor workaround found.
• Keep the data-dts service off the internet; allow access only via VPN or allow-listed networks.
• Restrict outbound database connections from the data-dts host.
• Verify the authentication configuration in WebSecurityConfiguration.java.

Exploitation

• CISA SSVC: exploitation status 'poc', automatable: yes, technical impact: partial.
• VulDB states no exploit is available.
• No evidence of in-the-wild exploitation found; CISA KEV not checked.
• Impact descriptions conflict between sources (remote DoS versus remote file read).

Our recommendation

• Inventory whether AllData is deployed in your environment. If not, no action needed.
• If deployed, take the data-dts component offline or isolate it from untrusted networks until a fixed release is confirmed.
• Restrict outbound connections from the data-dts host and monitor for unexpected database connections and file access.
• Check the vendor repository and NVD for a fix and update when available.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• AllData GitHub repository github.com
• WebSecurityConfiguration.java (release 0.7.1) github.com
• JobDatasourceController.java (release 0.7.1) github.com
• BaseQueryTool.java (release 0.7.1) github.com
• VulnCheck advisory www.vulncheck.com
• HackMD write-up hackmd.io
• VulDB entry 421379 vuldb.com
• OSV record CVE-2026-111613 osv.dev

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:16.