CVE-2026-111693 in DataBuff ai-apm-web
Summary
by MITRE • 10/16/2026
DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator token and access all protected /webapi routes.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/17/2026
The vulnerability identified in DataBuff ai-apm-web versions up to 0.1.10 represents a critical failure in authentication security, specifically categorized as CWE-798: Use of Hard-coded Credentials. This flaw stems from the application's design choice to embed default administrative credentials directly within the source code or configuration files rather than requiring unique credential generation during installation or initial setup. The specific account affected is an administrator-level user with the username admin and a static password of Databuff@123. Because these credentials are hard-coded, they remain constant across all installations of the vulnerable software versions, creating a predictable attack surface that any external actor can exploit without needing to perform reconnaissance or brute-force attacks against specific target instances.
The operational impact of this vulnerability is severe due to the privilege level associated with the compromised account. By submitting POST requests containing these hard-coded credentials to the authentication endpoint located at /webapi/api/v1/auth/login, an unauthenticated attacker can successfully obtain a valid administrator token. This token serves as proof of identity for subsequent interactions with the application's API infrastructure. Once authenticated, the attacker gains unrestricted access to all protected routes within the /webapi namespace. In the context of an Application Performance Monitoring (APM) tool like DataBuff, administrative access typically implies the ability to view sensitive telemetry data, modify monitoring configurations, manage user accounts, and potentially execute commands on the underlying infrastructure if such capabilities are exposed through the API. This effectively results in a complete compromise of the application's confidentiality, integrity, and availability depending on how the APM tool integrates with other systems.
From a threat modeling perspective aligned with MITRE ATT&CK frameworks, this vulnerability facilitates initial access techniques similar to T1078: Valid Accounts, where attackers leverage legitimate credentials that have been compromised or are known by default. The exploitation path is straightforward and does not require complex chaining of vulnerabilities, making it highly attractive for automated scanning tools and opportunistic attacks. Attackers can rapidly identify vulnerable instances on the internet using search engines or specialized scanners looking for exposed API endpoints, then immediately authenticate using the hardcoded credentials to establish a persistent foothold within the network environment monitored by the APM tool.
Mitigation strategies must focus on eliminating hard-coded secrets from production environments and enforcing strict access controls. The primary remediation step is to upgrade DataBuff ai-apm-web to a version greater than 0.1.10, where this issue has presumably been addressed by removing or randomizing default credentials upon installation. For organizations unable to immediately patch the software, it is imperative to ensure that the application is not exposed directly to untrusted networks such as the public internet. If exposure is necessary for legitimate business operations, a reverse proxy should be configured in front of the API gateway to enforce additional authentication layers or IP whitelisting before requests reach the vulnerable endpoint. Furthermore, security monitoring systems should be tuned to detect POST requests to /webapi/api/v1/auth/login that result in successful token generation using known default credential patterns, allowing for rapid detection and response to ongoing exploitation attempts. Regular audits of application configurations are also recommended to ensure no other hard-coded secrets exist within the deployment artifacts.