CVE-2026-111692 databufflabs CVE debrief

Who should care

System administrators and security teams responsible for DataBuff ai-apm-web deployments should assess exposure and prioritize remediation based on the potential impact to their environments. This includes verifying the presence of the hardcoded HMAC secret, reviewing system configurations, and implementing compensating controls to restrict access to /webapi routes. Additionally, they should monitor for potential exploitation attempts and review relevant

Why it matters

CVE-2026-111692 is a critical authentication bypass vulnerability in DataBuff ai-apm-web through version 0.1.10. The vulnerability allows unauthenticated attackers to forge admin session tokens using a hardcoded HMAC secret in JwtTokenService. This can grant full administrative access to protected /webapi routes, including the Doris SQL query API. System administrators and security teams should assess exposure and prioritize remediation.

• Potential unauthorized access to /webapi routes
• Possible exploitation of the Doris SQL query API
• Need for verification of affected versions and presence of hardcoded secret
• Priority remediation for DataBuff ai-apm-web version 0.1.10 and earlier

Technical summary

The vulnerability is caused by a hardcoded HMAC secret in JwtTokenService, which allows unauthenticated attackers to forge admin session tokens. This can grant full administrative access to protected /webapi routes, including the Doris SQL query API. The hardcoded secret is a significant risk, as it enables attackers to bypass authentication mechanisms. System administrators and security teams should verify the presence of the hardcoded secret and assess exposure to prioritize remediation for DataBuff ai-apm-web version 0.1.10 and earlier.

Defensive priority

High priority remediation is recommended for DataBuff ai-apm-web version 0.1.10 and earlier. System administrators and security teams should verify the presence of the hardcoded secret and assess exposure.

Recommended defensive actions

• Verify the presence of the hardcoded HMAC secret in JwtTokenService
• Assess exposure and prioritize remediation for DataBuff ai-apm-web version 0.1.10 and earlier
• Implement compensating controls to restrict access to /webapi routes
• Monitor for potential exploitation attempts
• Review relevant logs for exposed assets that need extra review
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including the hardcoded HMAC secret and affected versions. However, additional information on exploitation and impact is limited. Defenders should verify the presence of the hardcoded secret, assess exposure, and prioritize remediation for DataBuff ai-apm-web version 0.1.10 and earlier. The lack of detailed information on exploitation attempts or successful attacks makes it essential to focus on preventive measures.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.