CVE-2026-111613
High · 7.5CVSS
7.5
EPSS
0.6%
Published
Oct 16, 2026
CISA due date
—
The record
AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with allowLoadLocalInfile=true pointing to an attacker-controlled server to read arbitrary files from the data-dts host.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-63399 Coop is an open source review and moderation tool from ROOST. CWE-306
- CVE-2026-63396 Coop is an open source review and moderation tool from ROOST. CWE-306
- CVE-2026-63377 TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query… CWE-306
- CVE-2026-62863 MoLing is a computer-use and browser-use based MCP server. CWE-306
- CVE-2026-62302 MyTube is a self-hosted downloader and player for several video websites. CWE-306
- CVE-2026-62264 PDF Reader MCP is a Model Context Protocol server for reading PDF documents. CWE-306
- CVE-2026-119705 SerpBear before 3.1.1 contains a missing authentication vulnerability in… CWE-306
- CVE-2026-61730 SOCFortress CoPilot focuses on providing a single pane of glass for all your security… CWE-306