CVE-2026-111696 — data-platform-open through commit efeacd3 Hardcoded AES Key for Datasource Passwords
data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored…
Published: 2026-10-16 · CVSS: 7.1 · CVSS 4.0
data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via cross-workspace IDOR, and decrypt them offline to recover plaintext database credentials.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7