---
id: CVE-2026-122009
title: >-
  DataLinkDC Dinky flink_web Proxy Endpoint FlinkWebURITemplateProxyServlet.java
  FlinkWebURITemplateProxyServlet.getNewTargetUri server-side request forgery
summary: >-
  A flaw has been found in DataLinkDC Dinky up to 1.2.5. This vulnerability
  affects the function FlinkWebURITemplateProxyServlet.getNewTargetUri of the
  file
  dinky-admin/src/main/java/org/dinky/utils/FlinkWebURITemplateProxyServlet.java
  of …
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-918
vendor: DataLinkDC
product: Dinky
affected:
  - Dinky 1.2.0
  - Dinky 1.2.1
  - Dinky 1.2.2
  - Dinky 1.2.3
  - Dinky 1.2.4
  - Dinky 1.2.5
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T20:30:17.574Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-122009'
references:
  - url: 'https://vuldb.com/vuln/431072'
    label: >-
      VDB-431072 | DataLinkDC Dinky flink_web Proxy Endpoint
      FlinkWebURITemplateProxyServlet.java
      FlinkWebURITemplateProxyServlet.getNewTargetUri server-side request
      forgery
  - url: 'https://vuldb.com/vuln/431072/cti'
    label: 'VDB-431072 | CTI Indicators (IOB, IOC, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-122009'
    label: CVE-2026-122009 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1015959'
    label: >-
      Submit #1015959 | DataLinkDC dinky v1.2.5 (unfixed through master
      2026-09-18) Server-Side Request Forgery (SSRF)
  - url: >-
      https://github.com/DataLinkDC/dinky/security/advisories/GHSA-wchp-mjj9-wxqh
  - url: 'https://github.com/DataLinkDC/dinky/'
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.562Z'
epss: 0.005
epssPercentile: 0.43134
---

## Overview

A flaw has been found in DataLinkDC Dinky up to 1.2.5. This vulnerability affects the function FlinkWebURITemplateProxyServlet.getNewTargetUri of the file dinky-admin/src/main/java/org/dinky/utils/FlinkWebURITemplateProxyServlet.java of the component flink_web Proxy Endpoint. This manipulation of the argument _authority causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The researcher claims to have submitted a GHSA on the repository of the project.

## Affected

- `Dinky 1.2.0`
- `Dinky 1.2.1`
- `Dinky 1.2.2`
- `Dinky 1.2.3`
- `Dinky 1.2.4`
- `Dinky 1.2.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.