CVE-2026-111613

AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with allowLoadLocalInfile=true pointing to an attacker-controlled server to read arbitrary files from the data-dts host.

An unauthenticated attacker can read arbitrary files from the server, including credentials and configuration, leading to data leakage and potential further escalation. The vulnerability is especially dangerous because it requires no authentication.

Upgrade AllData to a version later than 0.7.1 if available, or restrict access to the /jobJdbcDatasource/test endpoint. Where possible, disable allowLoadLocalInfile and validate jdbcUrl and jdbcDriverClass values.