CVE-2026-75330: Super-diamond-server SQL Injection Flaw

CVE-2026-75330 Overview

CVE-2026-75330 is a SQL injection vulnerability in super-diamond-server versions 1.3.3 and earlier. The flaw resides in the front-end interface /superdiamond/preview/{projectCode}/{module}/{type}. The module parameter is passed through StringUtils.split() and concatenated directly into a SQL IN clause without parameter binding. Attackers can inject arbitrary SQL fragments through this parameter to manipulate the underlying database query.

Critical Impact
An attacker who can reach the preview endpoint can execute arbitrary SQL against the super-diamond configuration database, exposing credentials, application secrets, and centralized configuration data.

Affected Products

super-diamond-server versions <= 1.3.3
The /superdiamond/preview/{projectCode}/{module}/{type} endpoint
Downstream applications relying on super-diamond for centralized configuration

Discovery Timeline

2026-08-26 - CVE-2026-75330 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-75330

Vulnerability Analysis

super-diamond is a distributed configuration management server. The preview interface accepts three path parameters: projectCode, module, and type. The server splits the module value using StringUtils.split() to build an IN (...) clause listing multiple module names.

The resulting tokens are appended into the SQL string through string concatenation. No prepared statement or parameter binding is applied, so any SQL metacharacters supplied in module are treated as query syntax. This is a classic first-order SQL injection [CWE-89] in a dynamic IN list.

Because the vulnerable route is a preview endpoint, an authenticated or otherwise reachable caller can extract data from the configuration store. Configuration servers typically hold database URLs, service credentials, and API keys used by every consuming application.

Root Cause

The root cause is unsafe SQL construction. The developer used StringUtils.split() and manual concatenation to expand a variable-length IN list rather than generating a parameterized placeholder per token. Input validation on the module path segment is also missing, so quote characters, comment markers, and UNION statements pass through unchanged.

Attack Vector

An attacker crafts an HTTP request to /superdiamond/preview/{projectCode}/{module}/{type} with a malicious payload in the module segment. The payload closes the string literal in the IN clause and appends attacker-controlled SQL such as UNION SELECT statements. The server evaluates the injected query and returns data through the preview response or via boolean and time-based inference.

A public proof-of-concept documenting the request format is available at the GitHub PoC for SQL Injection.

Detection Methods for CVE-2026-75330

Indicators of Compromise

HTTP requests to /superdiamond/preview/ containing URL-encoded quotes, UNION, SELECT, --, or SLEEP( in the module segment
Unusually long path segments in the third URL component of the preview route
Application logs showing SQL syntax errors originating from the preview handler
Outbound database traffic spikes correlated with preview endpoint access

Detection Strategies

Deploy a web application firewall rule that inspects the module path segment for SQL metacharacters
Enable database query logging and alert on queries containing IN ( clauses with unusual token counts or embedded subqueries
Correlate authentication logs with preview endpoint access to identify unexpected callers
Hunt for repeated 500-class responses from the preview route, which often indicate injection probing

Monitoring Recommendations

Ship super-diamond access and application logs to a centralized SIEM for query pattern analysis
Monitor for schema enumeration queries against information_schema originating from the super-diamond database user
Alert on any successful response body returned from the preview endpoint that exceeds expected size baselines

How to Mitigate CVE-2026-75330

Immediate Actions Required

Restrict network access to the super-diamond-server management interface using firewall or reverse proxy allowlists
Require authentication and authorization on the /superdiamond/preview/ route if not already enforced
Review database audit logs for evidence of injection attempts against the preview endpoint
Rotate database credentials and any secrets stored inside super-diamond if exploitation is suspected

Patch Information

No vendor patch is referenced in the NVD entry at publication. Users of super-diamond-server <= 1.3.3 should track the project repository for a fixed release and apply source-level fixes that replace string concatenation in the preview query with parameterized placeholders bound per split token.

Workarounds

Block or filter requests where the module path segment contains characters outside [A-Za-z0-9_,-]
Deploy a reverse proxy rule that rejects preview requests containing SQL keywords such as UNION, SELECT, or SLEEP
Run super-diamond with a database account limited to SELECT on required tables to reduce injection blast radius
Isolate the super-diamond host on a management VLAN reachable only by trusted administrators

bash

# Example NGINX filter for the vulnerable route
location ~ ^/superdiamond/preview/ {
    if ($request_uri ~* "(union|select|sleep\(|--|/\*|information_schema)") {
        return 403;
    }
    proxy_pass http://superdiamond_backend;
}