alldata CVE-2026-19826

Q: What is the CVSS score of CVE-2026-19826?

CVE-2026-19826 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-58657 MEDIUM

Improper Input Validation (CWE-20)

2026-08-14 cna@vuldb.com

GHSA-fq8p-5fjc-mw7x

Java Deserialization

5.5

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Network-accessible Hessian2 deserialization endpoint with no authentication; Java deserialization via Hessian2 in enterprise-adjacent classpath environments typically yields full RCE, warranting C/I/A:H regardless of the CNA's limited-impact scoring.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 13:32 vuln.today

DescriptionCVE.org

A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java of the component xxl-rpc Listener. The manipulation results in deserialization. The attack may be performed from remote. The exploit is now public and may be used. The project closed the issue report as "not planned" without any further explanation.

AnalysisAI

Unsafe Java deserialization in alldatacenter alldata up to version 0.6.8 exposes the xxl-rpc Listener to remote, unauthenticated exploitation via crafted Hessian2-serialized payloads. The Hessian2Input.readObject() function in HessianSerializer.java processes attacker-controlled input without class validation, enabling object deserialization attacks that can activate gadget chains present in the application's JVM classpath. A public proof-of-concept exploit is available, the project has formally declined to issue a patch, and all users on affected versions face a permanent unmitigated known risk.

Technical ContextAI

The alldata platform integrates the xxl-rpc remote procedure call framework, which uses the Hessian2 binary serialization protocol for inter-service communication. The vulnerable entry point, Hessian2Input.readObject() in /serialize/impl/HessianSerializer.java, deserializes incoming binary data without allowlist-based class filtering or structural validation - the root cause classified as CWE-20 (Improper Input Validation), though CWE-502 (Deserialization of Untrusted Data) is arguably the more precise taxonomy. Java deserialization attacks are well-documented: when the JVM processes attacker-supplied serialized objects, it instantiates arbitrary classes and invokes their methods, which - if the classpath includes common gadget libraries such as Apache Commons Collections or Spring Framework components - can be chained into full remote code execution. The Hessian2 protocol has been the same vector exploited in high-severity Apache Dubbo deserialization CVEs (e.g., CVE-2021-43297). The affected software is the alldatacenter alldata open-source big data integration platform, versions up to 0.6.8.

RemediationAI

No vendor-released patch exists; the project maintainers formally closed GitHub issue #832 as 'not planned' without explanation, making this an indefinitely unpatched vulnerability. The primary compensating control is network-level isolation: restrict access to the xxl-rpc listener port using host-based firewall rules or network ACLs so only trusted internal services can reach the endpoint - note this may break legitimate RPC consumers and requires reconfiguring dependent microservices before enforcement. Where the xxl-rpc Hessian2 endpoint is not operationally required, disable it entirely at the application configuration level; this eliminates the attack surface at the cost of losing any RPC-dependent functionality. Organizations with a hard dependency on this component should evaluate migrating to an actively maintained alternative platform with a supported serialization mechanism. As a longer-term application-level fix, replacing Hessian2 deserialization with a JSON-based transport or implementing an explicit class allowlist in the deserializer (using Hessian2Input.setAllowClassNameHandler or equivalent) would address the root cause. Details are documented at https://github.com/alldatacenter/alldata/issues/832 and https://vuldb.com/vuln/389959.