CVE-2026-75329: Netty configuration distribution service vulnerability
The Netty configuration distribution service (port 8283) of super-diamond-server <= 1.3.3 has no authentication mechanism. Attackers can directly obtain the full configuration of any project (including database passwords, API keys, etc.) by sending a TCP request without any credential.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
super-diamond-serverto a version that resolves this vulnerability.Fixed in 1.3.3 - Compensating control
Disable or block network access to the Netty configuration distribution service listening on TCP port 8283 for super-diamond-server versions <= 1.3.3 until authentication is available.
Event History
Frequently Asked Questions
What access does an attacker need to retrieve configuration data?
An attacker only needs network access to the Netty configuration distribution service on port 8283. The service has no authentication mechanism, so no credentials are required.
What information could be exposed through this service?
An attacker can obtain the full configuration for any project. Exposed configuration may include database passwords, API keys, and other secrets stored in project configuration.
Which deployments are affected?
super-diamond-server versions 1.3.3 and earlier are affected where the Netty configuration distribution service is reachable on port 8283.