Northstar CVE-2026-88391

Exploitation requires that the Northstar H2 Console endpoint (/h2-console) be network-reachable by the attacker, which is the default state in versions <= 9.1.1 because the application enables the H2 Console and its auth interceptor scopes only /northstar/**, leaving /h2-console entirely unauthenticated. The embedded H2 database must retain its default sa account with an empty password (also the shipped default). No user interaction, no valid application credentials, and no non-default configuration are needed - the limiting factor is purely network reachability of the Northstar instance; isolating the service from untrusted networks or restricting/disabling the H2 Console endpoint eliminates the exposure.

This is a genuine high-priority issue, not a CVSS-inflated paper risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, pre-authentication exploitation, and the description corroborates it precisely: the H2 Console ships enabled, the auth interceptor only covers /northstar/** so /h2-console is left unauthenticated, and the embedded H2 DB uses default sa/empty credentials, enabling arbitrary command execution via CREATE ALIAS (CWE-94). The CVSS network/no-auth signal and the technical description agree - there is no conflict between vector and prose here. Publicly available exploit code exists (a GitHub write-up at fangtang7/CVE documents the H2 RCE), which raises real-world risk above a theoretical finding. However, this is NOT confirmed actively exploited: there is no CISA KEV listing in the input, and no EPSS probability was supplied, so the likelihood of widespread opportunistic scanning cannot be quantified from the data provided. The tempering factor is deployment footprint: Northstar (dromara/northstar) is a niche open-source quantitative trading platform, so despite the near-perfect CVSS score the realistic blast radius is small and likely limited to self-hosted instances exposed to reachable networks. Net: treat as urgent for any organization running Northstar <= 9.1.1, but it is a low-prevalence product rather than an internet-wide emergency.

An attacker who can reach the Northstar web port browses directly to /h2-console, which is served without authentication because the interceptor only guards /northstar/**, and logs into the embedded H2 database using the default sa account with an empty password. Using an H2 CREATE ALIAS statement that wraps a Java/system call, the attacker executes arbitrary operating-system commands on the host as the application user. A public exploit write-up demonstrating this H2 RCE already exists.