CVE-2026-88391: n/a

The Northstar quantitative trading platform (dromara/northstar) versions up to and including 9.1.1 have a security flaw where the H2 Console is enabled but its authentication interceptor only protects paths under /northstar/**. The /h2-console endpoint remains exposed without authentication, and the embedded H2 database uses the default 'sa' user with an empty password. This configuration permits an unauthenticated attacker with network access to execute arbitrary system commands by leveraging the CREATE ALIAS functionality in H2, leading to remote code execution prior to authentication.

An unauthenticated attacker who can reach the vulnerable service over the network can execute arbitrary system commands on the host running Northstar. This results in a full compromise of the affected system without requiring any credentials or prior access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the /h2-console endpoint, disable the H2 Console if not needed, and change default database credentials to prevent unauthorized access.