CVE-2026-111693 is a critical (CVSS 3.1 9.8) flaw in DataBuff ai-apm-web through version 0.1.10. A built-in administrator account uses a hard-coded default password, so unauthenticated attackers can get administrator access to the DataBuff application over the network.
What Is It
DataBuff ai-apm-web ships with a built-in administrator account that uses the hard-coded default credentials admin / Databuff@123. VulnCheck disclosed the issue and classifies it as CWE-1392 (Use of Default Credentials). An attacker can POST these credentials to /webapi/api/v1/auth/login to get an administrator token. That token gives access to every protected /webapi route. The attacker needs no prior authentication and no user interaction.
Why It Matters
VulnCheck rates the flaw CRITICAL under both scoring systems:
- CVSS 3.1: 9.8 (
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - CVSS 4.0: 9.3
It is reachable over the network, has low attack complexity, and needs no privileges. A successful login gives full administrator access to the application, which means high impact on confidentiality, integrity and availability. The credentials and login endpoint are public in the CVE description and the vendor's source code, so any exposed instance still using the default account is trivially accessible.
This CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied data does not confirm active exploitation. NVD lists the record's status as "Deferred."
What's Vulnerable
- Vendor: databufflabs
- Product: DataBuff (ai-apm-web component)
- Affected versions: all versions through 0.1.10 inclusive (
pkg:github/databufflabs/databuff)
The hard-coded account is defined in PortalUserManagementService.java in the v0.1.10 source tree. The NVD record does not list specific CPEs.
Patch Status
The supplied NVD and KEV data name no fixed version and no vendor patch. Because the issue is not in KEV, there is no CISA required action or due date. Organizations running DataBuff ai-apm-web 0.1.10 or earlier should check the vendor repository and the VulnCheck advisory for remediation updates. They should also confirm whether the built-in admin account is still active with its default password on any deployed instance.
Sources
- NVD, CVE-2026-111693
- VulnCheck Advisory; DataBuff ai-apm-web through 0.1.10 hard-coded default admin credentials
- GitHub; databufflabs/databuff
- GitHub; PortalUserManagementService.java (v0.1.10)
- HackMD, DataBuff default JWT secret auth bypass write-up (a separate DataBuff issue involving a default JWT secret, not the hard-coded credentials in this CVE)