The vulnerability CVE-2026-70559 in DataLinkDC's Dinky v1.2.5 involves the SysConfigController.getAll() handler for the GET /api/sysConfig/getAll endpoint. The method is annotated with @SaIgnore, which bypasses the class-level @SaCheckLogin authentication check, allowing unauthenticated access. As a result, any remote attacker who can reach the HTTP port (default 8888) can retrieve the entire system configuration, including sensitive credentials such as sys.env.settings.dinkyToken, LDAP user passwords, OSS access and secret keys, and DolphinScheduler tokens in cleartext. The shipped default includes hardcoded credentials like the dinkyToken and OSS keys. This exposure defeats token rotation mitigation for a related POST /download/uploadFromRsByLocal arbitrary file write vulnerability that relies on the dinkyToken for authorization. The affected code is byte-identical in the development branch as well. No patch or official fix has been published as of the data provided.

An unauthenticated remote attacker can retrieve sensitive system configuration data, including multiple credential fields in cleartext, from the Dinky server. This exposure can lead to compromise of third-party services integrated with Dinky, such as LDAP, object storage, and DolphinScheduler. Additionally, the disclosure of the dinkyToken credential allows bypassing protections on an arbitrary file write vulnerability, increasing the risk of remote code execution or system compromise. The vulnerability affects confidentiality but does not directly impact integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the Dinky HTTP port (default 8888) to trusted users only. Avoid exposing the service to untrusted networks. Monitor for updates from DataLinkDC regarding patches or configuration changes that address this authentication bypass.