Threat database

data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via cross-workspace IDOR, and decrypt them offline to recover plaintext database credentials.

CVE-2026-111695 is an authorization bypass vulnerability in shaiwz data-platform-open that allows authenticated workspace members to access and manipulate other workspaces' datasources by exploiting insecure direct object references via numeric IDs. Attackers can retrieve JDBC credentials, enumerate database schemas, and modify or delete datasources by sending crafted requests to specific API endpoints.