A flaw in DataLinkDC Dinky, present in all releases up to 1.2.5, allows an attacker to manipulate the _authority argument in the FlinkWebURITemplateProxyServlet.getNewTargetUri method. This input validation weakness, classified as CWE‑918, creates a server‑side request forgery condition that can be triggered remotely. An attacker can use the vulnerable endpoint to force the server to perform arbitrary HTTP requests against internal hosts, potentially exposing sensitive data or enabling further exploitation within the internal network.

The affected vendor is DataLinkDC, product Dinky, which includes the flink_web Proxy Endpoint component. All publicly available releases in the 1.x series up to 1.2.5 are impacted.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. However, the existence of a published exploit and the remote nature of the attack mean that the vulnerability remains a practical threat. Organizations running unpatched instances of Dinky should treat the issue as a medium‑to‑high risk until a fix or mitigative controls are in place.