CVE-2026-3052

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-3052
A vulnerability was found in DataLinkDC dinky up to 1.2.5. The impacted element is the function proxyUba of the file dinky-admin/src/main/java/org/dinky/controller/FlinkProxyController.java of the component Flink Proxy Controller. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

6.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

6.5 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://github.com/AnalogyC0de/public_exp/issues/7 Exploit Issue Tracking Third Party Advisory
https://github.com/AnalogyC0de/public_exp/issues/7#issue-3935032160 Exploit Issue Tracking Third Party Advisory
https://vuldb.com/?ctiid.347410 Permissions Required Third Party Advisory VDB Entry
https://vuldb.com/?id.347410 Third Party Advisory VDB Entry
https://vuldb.com/?submit.757587 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:dinky:dinky:*:*:*:*:*:*:*:*
History

25 Feb 2026, 19:59

Type Values Removed Values Added
CPE cpe:2.3:a:dinky:dinky:*:*:*:*:*:*:*:*
First Time Dinky
Dinky dinky
Summary
  • (es) Se encontró una vulnerabilidad en DataLinkDC dinky hasta 1.2.5. La cual impacta a la función proxyUba del archivo dinky-admin/src/main/java/org/dinky/controller/FlinkProxyController.java del componente Flink Proxy Controller. Si se manipula se puede lograr una falsificación de petición del lado del servidor. Es posible iniciar el ataque en remoto. El exploit ha sido hecho público y podría ser usado. El proveedor fue contactado con antelación sobre esta divulgación pero no respondió de ninguna manera.
References () https://github.com/AnalogyC0de/public_exp/issues/7 - () https://github.com/AnalogyC0de/public_exp/issues/7 - Exploit, Issue Tracking, Third Party Advisory
References () https://github.com/AnalogyC0de/public_exp/issues/7#issue-3935032160 - () https://github.com/AnalogyC0de/public_exp/issues/7#issue-3935032160 - Exploit, Issue Tracking, Third Party Advisory
References () https://vuldb.com/?ctiid.347410 - () https://vuldb.com/?ctiid.347410 - Permissions Required, Third Party Advisory, VDB Entry
References () https://vuldb.com/?id.347410 - () https://vuldb.com/?id.347410 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.757587 - () https://vuldb.com/?submit.757587 - Third Party Advisory, VDB Entry

24 Feb 2026, 02:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-24 02:16

Updated : 2026-02-25 19:59

NVD link : CVE-2026-3052

Mitre link : CVE-2026-3052

CVE.ORG link : CVE-2026-3052

JSON object : View

Products Affected

dinky

  • dinky
CWE
CWE-918

Server-Side Request Forgery (SSRF)