DataBuff ai-apm-web: Hard-coded default administrator credentials

Summary

DataBuff ai-apm-web through version 0.1.10 ships with a built-in administrator account that has a hard-coded, publicly documented default password. An unauthenticated attacker who can reach the login endpoint /webapi/api/v1/auth/login can obtain an administrator token and access all protected /webapi routes. Because APM administrators can usually see monitored systems and change monitoring configuration, the impact may extend beyond the APM tool itself.

Affected

• DataBuff ai-apm-web, versions 0 through 0.1.10 (vendor repository: databufflabs/databuff)
• Default configuration: the built-in administrator account is active.

Fixed in

Unknown. No vendor advisory or patched release has been confirmed. Check the vendor repository releases and tags for a version above 0.1.10.

Workaround

• Restrict network access to the DataBuff ai-apm-web instance, especially the /webapi/api/v1/auth/login endpoint, and keep it off the public internet.
• Place the administration interface behind a VPN or an identity-aware proxy.
• Ask the vendor whether the built-in account can be disabled or removed. The password cannot be changed as a fix, because the account is hard-coded.

Exploitation

• No evidence of exploitation in the wild in the reviewed sources. CISA KEV status was not checked directly.
• CISA SSVC assessment: exploitation 'poc', automatable 'yes', technical impact 'total'.
• Low effort is expected for anyone who can reach the login endpoint.

Our recommendation

• Check whether any DataBuff ai-apm-web instance exists, including test, demo or vendor-hosted systems, and whether it is reachable from the internet.
• Restrict access to the instance immediately, starting with the login endpoint.
• Review admin logins, new users, sessions and monitoring configuration changes. Assume compromise if an exposed instance was reachable before it was restricted.
• Monitor for successful POST requests to /webapi/api/v1/auth/login from unexpected sources.
• Plan an upgrade once a fixed version is confirmed. Also check CVE-2026-111692, a separate authentication bypass in the same product.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• DataBuff GitHub repository github.com
• Vulnerable code, DataBuff v0.1.10 (PortalUserManagementService.java) github.com
• VulnCheck advisory: DataBuff ai-apm-web hard-coded default admin credentials www.vulncheck.com
• VulDB entry CVE-2026-111693 vuldb.com
• Strix CVE entry CVE-2026-111693 www.strix.ai
• The Hacker Wire: CVE-2026-111693 www.thehackerwire.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:25.