CVE-2026-111693 is a default credentials flaw (CWE-1392) in DataBuff ai-apm-web through 0.1.10, scored 9.8 critical. A built-in administrator account with a fixed password gives full access to the web API. Change that account's password and restrict access. I could not confirm a fixed release.
What's affected
DataBuff ai-apm-web through 0.1.10, per the CVE record. The record says the application ships a built-in administrator account with a known password, and that its login endpoint returns an administrator token that opens all protected web API routes.
I could not confirm a fixed release, so check the project repository for a newer version and read its notes.
How to check if you're exposed
Check your deployment version. If it is 0.1.10 or earlier, treat it as affected.
Then test whether the built-in account still works, using your own admin tools on a trusted network and with the project's documentation. Do this on your own instance only. Check the user list in the admin console for the default account and for accounts you do not recognize.
Look at who can reach the web API. List the exposure of the application's ports and any reverse proxy rules.
You can also run the free in-browser dependency scan or browse the Gold directory to see where a package or product shows up in your stack.
What to do now
- Change the password of the built-in administrator account, or remove it and create a named admin.
- Restrict the web interface and API to a private network or an authenticating proxy.
- Review the user list and recent logins for accounts or sessions you do not recognize.
- Rotate API tokens and any credentials that monitoring agents use to talk to the server.
- Watch the project for a release that removes the default account, and upgrade when it ships.
Why it matters
A product that ships with the same administrator account everywhere is open to anyone who reads its source or docs. The class is CWE-1392, use of default credentials. The record says the account gets an administrator token and reaches all protected routes.
The product is an application performance monitoring tool, which means it sees traces, service names and configuration from the systems around it. Access to it tells an attacker a lot about the environment. Forcing a password change on first start is the standard design answer.
The record does not flag this CVE as exploited in the wild and it is not a CISA Known Exploited Vulnerability.
Quick check
Is changing the password enough?
It closes the default account problem. Also restrict network access and review other accounts and tokens.
Is a patched release available?
I could not confirm one. Check the project repository.
Sources
Last reviewed: 19 October 2026.
