StarTraining EUVD-2026-87235

Requires that the StarTraining application (<=3.8.1) be deployed with the Alibaba Druid monitoring Console (StatViewServlet at /druid/index.html) enabled and network-reachable without an authentication filter - the default/insecure Druid Console configuration. No credentials, user interaction, or special privileges are needed once the console is exposed. Exploitation is limited by whether the Druid Console is actually enabled and internet-facing (many deployments restrict it to internal networks or add a servlet auth filter) and by the small deployment base of the product; impact is bounded to monitoring-data disclosure and console reset actions rather than the underlying application or database.

This is a genuine but low-severity issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, unauthenticated, low-complexity access with no user interaction, which is why the base metrics read as easy to reach - but the impact is deliberately capped at VC:L/VI:L/VA:L and SC/SI/SA:N, producing a modest 6.9. The 'anonymous'/Druid Console context (CWE-306 missing authentication) is consistent with exposure of a database-monitoring interface rather than code execution or full data compromise. Public exploit code exists (GitHub ArrestX advisory, referenced by VulDB, and E:P in the vector), so exploitation is technically trivial where the product is reachable, but there is no CISA KEV listing and no EPSS score provided, so there is no evidence of active or widespread exploitation. Signals are internally consistent (network vector matches a web-exposed console; low impact matches a monitoring-console leak), with no CVSS-versus-description contradiction. Net: a real, easily-triggered exposure but a low real-world priority - the limiting factor is the obscurity and small footprint of the affected product, not the difficulty of exploitation. Note the vendor did not respond to disclosure, so no official patch is confirmed.

An attacker discovers a StarTraining instance (<=3.8.1) exposing /druid/index.html without authentication and browses directly to the Druid Console. Because no credentials are required, they read database connection-pool statistics, executed SQL, URI/session monitoring, and other operational data, and can invoke console reset actions. A public exploit/advisory (ArrestX ST-VULN-002) documents the exact endpoint and steps, lowering the skill needed.