The vulnerability CVE-2026-70559 in DataLinkDC's Dinky product affects version 1.2.5 and the development branch. The SysConfigController.getAll() handler for the GET /api/sysConfig/getAll endpoint is annotated with @SaIgnore, which bypasses the class-level @SaCheckLogin authentication. As a result, any unauthenticated remote user who can access the HTTP port (default 8888) can retrieve the entire live system configuration, including multiple sensitive credential fields returned in cleartext. This includes LDAP user passwords, OSS access and secret keys, DolphinScheduler tokens, and the hardcoded dinkyToken. The exposure of the dinkyToken credential undermines token rotation mitigations for a sibling POST endpoint vulnerable to arbitrary file write. The vulnerability has a CVSS 3.1 score of 7.5 (high severity) with network attack vector, no privileges required, no user interaction, and high confidentiality impact. No patch or official remediation is currently documented.

An unauthenticated remote attacker can retrieve the full system configuration, including multiple sensitive credentials in cleartext, from the vulnerable endpoint. This disclosure exposes hardcoded and live third-party credentials, enabling further attacks such as bypassing authentication on an arbitrary file write vulnerability. The confidentiality of the system is severely compromised, but integrity and availability are not directly impacted by this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the Dinky HTTP port (default 8888) to trusted users only. Monitor for any updates from the vendor regarding official patches or mitigations.