CVE-2026-111696: Use of Hard-coded Cryptographic Key in shaiwz data-platform-open

The data-platform-open product by shaiwz, specifically version 0, contains a hardcoded AES key in the AesPasswordEncAndDecServiceImpl implementation. This cryptographic key is publicly known and used to encrypt datasource passwords. Authenticated attackers can retrieve encrypted passwords from the datasource detail API, potentially exploiting cross-workspace Insecure Direct Object References (IDOR) to access ciphertexts from other workspaces. Using the hardcoded key, attackers can decrypt these ciphertexts offline to recover plaintext database credentials, compromising database security.

The vulnerability allows authenticated attackers to decrypt stored datasource passwords, leading to exposure of plaintext database credentials. This can result in unauthorized access to backend databases, potentially compromising sensitive data and system integrity. The attack requires authentication but does not require user interaction and has a high impact on confidentiality.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the datasource detail API to trusted users only and monitor for unauthorized access attempts. Consider rotating database credentials and avoid using hardcoded cryptographic keys in production environments.