Shaiwz Data-platform-open vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Shaiwz Data-platform-open: 2 record(s), with affected versions and fixes.

CVE-2026-111696 Medium · 6.5 CWE-321 Oct 16, 2026

data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in...

data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via cross-workspace IDOR, and decrypt them offline to recover plaintext database credentials.

CVE-2026-111695 High · 7.1 CWE-639 Oct 16, 2026

Shaiwz data-platform-open through commit efeacd3 IDOR in Datasource API

Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable, /tableDetail, /update or /delete to obtain JDBC credentials, enumerate database schemas, and modify or delete datasources.