AllData 0.7.1 Unauthenticated JDBC Injection Lets Attackers Read Files

AllData versions through 0.7.1 contain a high-severity unauthenticated JDBC injection flaw. Remote attackers can exploit this defect to open arbitrary database connections and read files from the host system without credentials.

What happened

The National Vulnerability Database records CVE-2026-111613 as affecting AllData software releases up to version 0.7.1. The flaw stems from improper handling of JDBC parameters in the data-dts jobJdbcDatasource test endpoint. Attackers do not need valid login credentials to trigger the vulnerability. By supplying specific jdbcUrl and jdbcDriverClass values, they can force the application to establish unauthorized database connections. This weakness is categorized under CWE-306, which relates to incorrect default permissions or initialization issues.

Why it matters

The vulnerability carries a CVSS score of 8.7, placing it in the High severity range. Attackers can craft a MySQL JDBC URL that includes the allowLoadLocalInfile parameter. This configuration allows the database driver to load data from local files on the server. By pointing this URL to an attacker-controlled server, the threat actor can instruct the AllData host to read arbitrary files. This effectively turns the application into a tool for local file disclosure. The lack of authentication requirements makes the target accessible to any network observer.

What to watch

• Monitor the data-dts endpoint for unusual jdbcUrl parameters.
• Check for outbound connections to unexpected database servers.
• Look for logs indicating local file access via JDBC drivers.
• Verify that no unauthorized database connections are initiated.

Who needs to act first

Teams usually prioritize systems exposed to the internet or untrusted networks. Check whether AllData instances are accessible without strong network segmentation. Reduce exposure by restricting access to the data-dts endpoint using firewall rules. Back up configuration files before making any changes to the environment. Test any mitigation steps in a non-production setting first. Ensure that logging is enabled to capture attempts to manipulate JDBC parameters. This approach helps limit the blast radius while waiting for a vendor update.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: AllData

• Restrict network access to the AllData data-dts endpoint to trusted IPs only.
• Monitor server logs for unusual JDBC connection attempts or file access patterns.
• Verify that no public-facing instances of AllData are running versions through 0.7.1.
• Wait for an official vendor update before applying any unofficial patches.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of AllData are affected by CVE-2026-111613?

AllData versions through 0.7.1 are affected by this vulnerability.

Is there a patch available for this JDBC injection flaw?

No fix has been confirmed yet by the vendor.

What is the CVSS score for CVE-2026-111613?

The vulnerability has a CVSS score of 8.7, which is rated as High.