CVE-2026-75329: n/a

CVE-2026-75329 identifies a critical authentication bypass vulnerability in the Netty configuration distribution service of super-diamond-server versions <= 1.3.3. The service listens on TCP port 8283 and does not require any credentials, enabling unauthenticated attackers to obtain complete configuration data for any project. This includes highly sensitive information such as database passwords and API keys. The vulnerability corresponds to CWE-306 (Missing Authentication for Critical Function). No official patch or remediation guidance is currently available, and no known exploits have been reported in the wild.

Successful exploitation allows an unauthenticated remote attacker to access full configuration details of any project managed by the super-diamond-server, including sensitive credentials like database passwords and API keys. This can lead to complete compromise of the affected system's confidentiality, integrity, and availability as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to port 8283 to trusted hosts only and consider implementing external authentication or network-level controls to prevent unauthorized access.