CVE-2026-75329: Super-Diamond-Server Information Disclosure

CVE-2026-75329 Overview

CVE-2026-75329 is an authentication bypass vulnerability in the Netty-based configuration distribution service of super-diamond-server version 1.3.3 and earlier. The service listens on TCP port 8283 without any authentication mechanism. Any attacker with network access to the port can send a crafted TCP request and retrieve the full configuration of any managed project. Exposed data includes database credentials, API keys, and other secrets stored in project configurations. The flaw affects centralized configuration management deployments, where a single compromised endpoint exposes secrets for every downstream application.

Critical Impact
Unauthenticated attackers can retrieve database passwords, API keys, and full project configurations by issuing a single TCP request to port 8283.

Affected Products

super-diamond-server version 1.3.3
super-diamond-server versions prior to 1.3.3
Deployments exposing TCP port 8283 to untrusted networks

Discovery Timeline

2026-08-26 - CVE-2026-75329 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-75329

Vulnerability Analysis

The super-diamond-server component distributes application configuration to clients through a Netty-based TCP service on port 8283. The protocol handler accepts configuration retrieval requests and returns the requested project configuration in its response. The handler does not validate any credentials, tokens, or client identity before serving data. A remote attacker who can reach the port can enumerate projects and download every stored configuration.

This is a missing authentication for critical function issue, aligned with [CWE-306]. The exposure is amplified because configuration servers typically consolidate secrets for multiple downstream services. A single successful request can yield credentials for databases, cloud APIs, message brokers, and internal services.

Root Cause

The Netty channel pipeline for the configuration distribution service omits an authentication handler. The protocol was designed to serve trusted internal clients and relies solely on network placement for access control. When the service is exposed beyond a trusted segment, or when an attacker gains a foothold on the internal network, the missing check permits direct retrieval of stored configuration payloads.

Attack Vector

An attacker connects to TCP port 8283 and sends a protocol-compliant request specifying a project identifier. The server responds with the serialized configuration for that project. No credentials, session state, or client certificate are required. Attackers can script enumeration across project identifiers to exfiltrate every configuration stored on the server. Details of the request format are documented in the GitHub CVE Research Document.

Detection Methods for CVE-2026-75329

Indicators of Compromise

Unexpected inbound TCP connections to port 8283 from hosts outside the application tier
Outbound data transfer spikes from the configuration server to unknown external IP addresses
Repeated short-lived TCP sessions to port 8283 consistent with project enumeration
Downstream service authentication failures that suggest exposed credentials are being reused elsewhere

Detection Strategies

Baseline the set of hosts that legitimately connect to the super-diamond-server on port 8283 and alert on deviations
Inspect Netty access logs and network flow records for repeated requests carrying different project identifiers from a single source
Correlate authentication anomalies on downstream databases and API gateways with connections to the configuration server

Monitoring Recommendations

Forward network flow data and Netty application logs into a centralized analytics platform for retention and correlation
Enable alerts on any external or DMZ-originated connection attempts to port 8283
Rotate any credential observed inside super-diamond configurations and monitor its usage for anomalous access

How to Mitigate CVE-2026-75329

Immediate Actions Required

Restrict TCP port 8283 at the host firewall and network perimeter to only known configuration client IP addresses
Move the super-diamond-server off any network segment reachable from the internet or untrusted zones
Rotate every secret stored in super-diamond project configurations, including database passwords and API keys
Audit connection logs for prior unauthorized retrievals and treat exposed secrets as compromised

Patch Information

No vendor patch is referenced in the public CVE record for versions at or below 1.3.3. Consult the GitHub CVE Research Document for the current state of remediation and migrate to a maintained configuration management platform that enforces authentication and transport encryption.

Workarounds

Place the configuration distribution service behind a mutually authenticated TLS proxy or service mesh that enforces client identity
Enforce host-based access control lists that limit source addresses permitted to reach port 8283
Wrap the Netty listener in a VPN or private network overlay so the port is not reachable from general corporate networks
Add an authenticating reverse proxy in front of the service until the underlying protocol is replaced

bash

# Example iptables rule limiting port 8283 to a known application subnet
iptables -A INPUT -p tcp --dport 8283 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8283 -j DROP