EUVD-2026-66803
GHSA-vh2m-57xh-992g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessScan for exposed TCP port 8283
-
DeliverySend unauthenticated config request
-
ExploitService returns full project configuration
-
ExecutionHarvest DB passwords and API keys
-
ImpactPivot into databases and external services
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The affected TCP port 8283 (the Netty configuration distribution service of super-diamond-server <= 1.3.3) must be network-reachable by the attacker; exploitation requires no credentials, no user interaction, and no special configuration because the service ships with no authentication mechanism at all. The primary limiting factor is network exposure: if port 8283 is bound to localhost or firewalled to trusted configuration clients only, remote attackers cannot reach it. A secondary limit is product prevalence - a SuperDiamond deployment at version 1.3.3 or earlier must actually be running and exposed. No platform-specific or feature-flag prerequisite applies since the missing-authentication condition is the default state. |
| Impact | The signals conflict on breadth versus real-world priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) describes trivially exploitable, unauthenticated network access, which is consistent with the description of an open TCP port returning secrets. However, the description only substantiates a confidentiality breach (reading configuration); the I:H and A:H claims are not supported by the described behavior and appear overstated - verify whether the service also permits unauthenticated writes before accepting integrity/availability impact. Countering the high CVSS, EPSS is very low (0.17%, 6th percentile), the flaw is NOT in CISA KEV, and there is no evidence of active exploitation. Combined with SuperDiamond's niche footprint, this reads as a genuinely serious but low-exposure issue: critical for the specific organizations running an internet-reachable SuperDiamond instance, but not a mass-exploitation event. Priority should be driven by whether port 8283 is exposed beyond a trusted network. |
| Exploit ScenarioDerived | An attacker scans for hosts exposing TCP port 8283, identifies a SuperDiamond instance, and sends a crafted TCP request to the Netty configuration service without any credentials. The service returns the full configuration for the requested project, handing the attacker database passwords and API keys that are then used to pivot into backend databases and third-party services. A public write-up describing the flaw exists, lowering the effort to reproduce it. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 27, 2026
Unauthenticated configuration disclosure in SuperDiamond (super-diamond-server) versions 1.3.3 and earlier exposes the Netty-based configuration distribution service on TCP port 8283 without any authentication mechanism. Any remote attacker who can reach the port can send a raw TCP request and retrieve the complete configuration of any managed project, including database passwords and API keys. A public write-up exists but there is no public exploit identified as weaponized tooling, and the flaw is not in CISA KEV; EPSS is low at 0.17% (6th percentile).
RemediationAI
No vendor-released patched version is identified in the available data, so a specific upgrade target cannot be cited. As the primary compensating control, prevent all untrusted network access to TCP port 8283 by binding the Netty service to localhost or a restricted management segment and enforcing firewall/security-group rules that allow only known configuration-client hosts - this directly closes the unauthenticated path with minimal functional trade-off since only legitimate SuperDiamond clients should reach that port. Additionally, rotate all secrets that may have been exposed (database passwords, API keys) since disclosure would compromise them regardless of a future patch, and place the service behind a network authentication layer (VPN, mTLS proxy, or bastion) if clients must connect across networks. Monitor the project repository and https://github.com/fangtang7/CVE/blob/main/super-diamond/NETTY-NOAUTH.md and https://nvd.nist.gov/vuln/detail/CVE-2026-75329 for a fixed release, and if migration is feasible consider a maintained configuration server as a longer-term measure.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SuperDiamond is a centralized/distributed configuration management server (analogous to Spring Cloud Config or Apollo) that stores and distributes application settings to client projects. The affected component is its configuration distribution channel implemented on Netty, a high-performance asynchronous Java network framework, listening on TCP port 8283. The root cause is CWE-306 (Missing Authentication for a Critical Function): the Netty listener accepts and answers configuration-retrieval requests without validating any credential or token, so the sensitive-data channel is effectively open. Because config servers centralize secrets for many downstream applications, the exposed data (DB credentials, API keys) is high-value. The CPE string in the source feed is malformed ('cpe:2.3:a:n/a:n/a:*') and provides no reliable product/version identification, so scoping relies on the description naming super-diamond-server <= 1.3.3.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote read of secrets over TCP gives AV:N/AC:L/PR:N and C:H; the description substantiates only disclosure, so I and A are set to N pending confirmation of write/DoS capability.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
The Netty configuration distribution service (port 8283) of super-diamond-server <= 1.3.3 has no authentication mechanism. Attackers can directly obtain the full configuration of any project (including database passwords, API keys, etc.) by sending a TCP request without any credential.
Executive ViewAI
Organizations running SuperDiamond 1.3.3 and earlier face direct exposure of production database passwords and API keys to any remote attacker without requiring credentials. This credential compromise could enable unauthorized database access, data exfiltration, and lateral movement into dependent systems. No vendor patch is currently available, requiring immediate network containment.
Restrict network access to port 8283 using firewall rules to trusted internal subnets only; implement network segmentation isolating SuperDiamond deployments; deploy monitoring and alerting on all configuration access attempts; immediately rotate and reset all exposed database passwords, API keys, and service credentials; audit dependent systems for unauthorized access using exposed credentials.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB