CVE-2026-75329

CriticalCVSS 9.8

Published: 26/08/2026(UTC)Updated: 31/08/2026(UTC)Translated: 27/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

25th percentile - higher than 25% of all known CVEs

Summary

The Netty configuration distribution service (port 8283) of super-diamond-server <= 1.3.3 has no authentication mechanism. Attackers can directly obtain the full configuration of any project (including database passwords, API keys, etc.) by sending a TCP request without any credential.

Risk Assessment

Lack of authentication allows unauthorized access to sensitive configuration data, potentially leading to secret leakage, system integrity compromise, or attacks on other components.

Recommendation

Implement authentication and authorization for the configuration distribution service, and restrict access to port 8283 to trusted hosts only.

Other vulnerabilities in super-diamond-server

CVE-2026-75330Critical
The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} in super-diamond-server <= 1.3.3 is vulnerable to SQL injection. The module parameter is directly concatenated into the SQL IN clause through StringUtils.split() and string concatenation without being parameterized and bound.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS