CVE-2026-111696 shaiwz CVE debrief

Who should care

Defenders and security teams responsible for systems using data-platform-open should assess exposure and prioritize remediation. This includes operators managing affected deployments, vulnerability management teams tracking exposure, and security teams verifying and remediating this high-severity vulnerability to prevent unauthorized access.

Why it matters

CVE-2026-111696 is a high-severity vulnerability allowing authenticated attackers to decrypt stored datasource passwords using a hardcoded AES key. Defenders should prioritize verification and remediation to prevent unauthorized access.

• Authenticated attackers can decrypt stored datasource passwords.
• Plaintext database credentials can be recovered offline.
• Defenders should verify and remediate this vulnerability to prevent unauthorized access.
• Remediation priority is high due to the publicly known hardcoded AES key.

Technical summary

The data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl. This allows authenticated attackers to decrypt stored datasource passwords by obtaining ciphertext passwords from the datasource detail API. The vulnerability is confirmed by the CVE Program and NVD records. The hardcoded AES key is publicly known and used in AesPasswordEncAndDecServiceImpl. Attackers can obtain ciphertext passwords from the datasource detail API, for example via cross-workspace IDOR, and decrypt them offline to recover plaintext database credentials.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability, especially in systems where datasource passwords are used.

Recommended defensive actions

• Verify if the vulnerable component is used in your systems.
• Check if the system uses the hardcoded AES key for datasource password encryption.
• Decrypt and verify stored datasource passwords.
• Remediate by updating to a version that does not use the hardcoded AES key.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is confirmed by the CVE Program and NVD records. The hardcoded AES key is publicly known and used in AesPasswordEncAndDecServiceImpl. Attackers can obtain ciphertext passwords from the datasource detail API.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.