What happened
CVE-2026-111692 (CVSS 9.8, CWE-321) verified via NVD REST API (published 2026-10-16 by VulnCheck): the JWT signing HMAC secret is hardcoded to a default dev-secret in JwtTokenService/config, so an unauthenticated attacker can forge an admin token with a future expiry and reach every protected /webapi route, including the Doris SQL query API. Companion CVE-2026-111693 (also CVSS 9.8) is the hard-coded default admin/Databuff@123 login.
Why it matters
AI observability/APM deployments that self-host DataBuff expose full write/read control of the monitoring stack — including an SQL query API over telemetry data — via two trivial unauthenticated paths (known signing secret and default creds). An attacker gains admin over AI workload monitoring and the underlying query engine.
Attack vector
Unauthenticated: attacker signs an admin-role JWT with the hardcoded HMAC secret from JwtTokenService, or POSTs default admin/Databuff@123 to /webapi/api/v1/auth/login, then accesses protected /webapi routes including the Doris SQL query API.
Affected systems
DataBuff ai-apm-web ≤ 0.1.10 (databufflabs/databuff)
Mitigation
Upgrade beyond 0.1.10; replace the default dev-secret with a random strong secret, disable/change the built-in admin account, and rotate credentials on any exposed deployment. See VulnCheck advisory.