CVE-2026-70559

Name of the Vulnerable Software and Affected Versions Dinky version 1.2.5

Description The getAll() function in the SysConfigController contains a method-level @SaIgnore annotation that bypasses the class-level @SaCheckLogin security check. This allows unauthenticated remote callers to access the GET /api/sysConfig/getAll endpoint without a session or role verification. Consequently, the full system configuration is exposed, including sensitive cleartext credentials such as sys.env.settings.dinkyToken, sys.ldap.settings.userPassword, sys.resource.settings.oss.accessKey, sys.resource.settings.oss.secretKey, and sys.dolphinscheduler.settings.token. This exposure includes hardcoded defaults in fresh installations and live third-party credentials configured by operators. Furthermore, the disclosure of dinkyToken compromises the security of the POST /download/uploadFromRsByLocal endpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the GET /api/sysConfig/getAll endpoint to minimize the risk of exploitation.