shaiwz CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH shaiwz CVE published 2026-10-16

CVE-2026-111696

CVE-2026-111696 is a vulnerability in data-platform-open through commit efeacd3, where a hardcoded, publicly known default AES key is used in AesPasswordEncAndDecServiceImpl. This allows authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API and decrypt them offline to recover plaintext database credentials.