CVE-2026-124558 DataLinkDC Dinky sql-gateway Endpoint SqlGateway.java SqlGateway.onOpen server-side request forgery
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-124558?
CVE-2026-124558 is a medium-severity vulnerability in DataLinkDC Dinky, published on 9 Nov 2026.
Official description
A vulnerability has been found in DataLinkDC Dinky up to 1.2.5. The impacted element is the function SqlGateway.onOpen of the file SqlGateway.java of the component sql-gateway Endpoint. Such manipulation of the argument connectAddress leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The researcher claims to have submitted a GHSA on the repository of the project.
Weakness: CWE-918
Which versions are affected by CVE-2026-124558?
How do I fix CVE-2026-124558?
No fix has been published for CVE-2026-124558 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-124558 being exploited?
There is no known exploitation of CVE-2026-124558 in the wild and no public exploit code.
Sources
Also known as GHSA-9hhv-xrpj-v2gw, GHSA-x4hx-f425-mrx6.