CVE-2026-111693: DataBuff APM: hard-coded admin credentials allow full takeover

CRITICALCISA: ATTEND

Published October 16, 2026

CISO Take

DataBuff ai-apm-web through version 0.1.10 ships with a built-in administrator account (admin/Databuff@123), so anyone who can reach the login endpoint can obtain an admin token with a single POST request and access every protected /webapi route. The flaw is rated critical (CVSS 9.8, network-reachable, no privileges, no user interaction), and the credentials are public in the vendor's source code and third-party advisories, which makes exploitation trivial. There is no EPSS score, KEV listing, public exploit or Nuclei template yet, but a one-request attack does not need tooling, and the VulnCheck and HackMD write-ups lower the bar further. APM platforms hold application topology, traces, and often tokens or secrets, so compromise gives attackers a map of your AI services plus a pivot point. Identify any exposed DataBuff instances, change or disable the default admin account immediately, restrict /webapi to trusted networks, and review login logs for the default account. No patched version is listed, so rotate credentials and apply compensating controls until the vendor ships a fix.

Sources:NVDATLASvulncheck.comhackmd.iogithub.com/databufflabs/databuff

What is the risk?

High to critical. Exploitation is trivial: a single unauthenticated POST with publicly documented credentials yields an administrator token. Impact covers confidentiality, integrity and availability of the monitoring platform. Exposure depends on whether the service is internet-facing; observability stacks are frequently reachable from internal networks and sometimes the internet. No known active exploitation or KEV listing as of publication, but the barrier to entry is minimal. No fixed version is identified, so risk persists until configuration changes are made. The package is not clearly tied to widely-used AI libraries, so the blast radius is limited to organizations running this specific APM product.

How does the attack unfold?

Initial Access

Attacker finds an exposed DataBuff ai-apm-web instance and posts the default admin/Databuff@123 credentials to /webapi/api/v1/auth/login.

AML.T0049

Credential Use

The server returns an administrator token that is accepted on all protected /webapi routes.

AML.T0012

Collection

Attacker harvests telemetry, traces, configuration and stored secrets covering monitored AI services.

AML.T0036

Impact

Attacker alters monitoring or alerts and pivots into AI infrastructure using harvested credentials.

Initial Access

Attacker finds an exposed DataBuff ai-apm-web instance and posts the default admin/Databuff@123 credentials to /webapi/api/v1/auth/login.

AML.T0049

Credential Use

The server returns an administrator token that is accepted on all protected /webapi routes.

AML.T0012

Collection

Attacker harvests telemetry, traces, configuration and stored secrets covering monitored AI services.

AML.T0036

Impact

Attacker alters monitoring or alerts and pivots into AI infrastructure using harvested credentials.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
databuff	—	—	No patch

Do you use databuff? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 42% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Inventory DataBuff ai-apm-web deployments (versions 0.1.10 and earlier) and check whether /webapi is reachable from untrusted networks. 2) Change the default admin password immediately and disable or remove the built-in admin account where possible; check the vendor repository (github.com/databufflabs/databuff) for a fixed release and upgrade once available. 3) Place the service behind a VPN, reverse proxy with authentication, or IP allowlist. 4) Detection: search web and application logs for POSTs to /webapi/api/v1/auth/login that succeed for user admin, especially from unfamiliar IPs, and review admin-token activity on /webapi routes. 5) Rotate any secrets, API keys or tokens stored in or accessible through the platform if exposure is suspected. 6) Review the referenced advisory about the default JWT secret and verify token signing keys are unique.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableYes

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassData LeakageFrameworkAPIAML.T0012- Valid Accounts AML.T0036- Data from Information Repositories AML.T0049- Exploit Public-Facing Application AML.T0055- Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks and manage third-party risk

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-111693?

Is CVE-2026-111693 actively exploited?

No confirmed active exploitation of CVE-2026-111693 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-111693?

1) Inventory DataBuff ai-apm-web deployments (versions 0.1.10 and earlier) and check whether /webapi is reachable from untrusted networks. 2) Change the default admin password immediately and disable or remove the built-in admin account where possible; check the vendor repository (github.com/databufflabs/databuff) for a fixed release and upgrade once available. 3) Place the service behind a VPN, reverse proxy with authentication, or IP allowlist. 4) Detection: search web and application logs for POSTs to /webapi/api/v1/auth/login that succeed for user admin, especially from unfamiliar IPs, and review admin-token activity on /webapi routes. 5) Rotate any secrets, API keys or tokens stored in or accessible through the platform if exposure is suspected. 6) Review the referenced advisory about the default JWT secret and verify token signing keys are unique.

What systems are affected by CVE-2026-111693?

This vulnerability affects the following AI/ML architecture patterns: AI observability and APM platforms, model serving monitoring, agent frameworks telemetry, MLOps infrastructure.

What is the CVSS score for CVE-2026-111693?

CVE-2026-111693 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.50%.

What is the AI security impact?

Affected AI Architectures

AI observability and APM platformsmodel serving monitoringagent frameworks telemetryMLOps infrastructure

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0036Data from Information Repositories

AML.T0049Exploit Public-Facing Application

AML.T0055Unsecured Credentials

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator token and access all protected /webapi routes.

Exploitation Scenario

An attacker scans for exposed DataBuff web consoles, then sends a POST to /webapi/api/v1/auth/login with admin/Databuff@123 and receives an administrator token. Using the token, they enumerate all monitored services, including LLM inference endpoints and agent backends, and pull traces that contain prompts, user data and embedded API keys. They then alter alerting rules to blind defenders, and use harvested credentials to move laterally into the AI infrastructure and cloud accounts.

Weaknesses (CWE)

CWE-1392Use of Default Credentials

CWE-1392 — Use of Default Credentials: The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.

[Requirements] Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.
[Architecture and Design] Force the administrator to change the credential upon installation.

Source: MITRE CWE corpus.