{"id":"CVE-2026-88391","published":"2026-10-05T15:17:22.697","lastModified":"2026-10-06T16:08:27.613","description":"Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/**, so /h2-console is exposed with no authentication and the embedded H2 DB uses default sa / empty password. Any network-reachable attacker can run arbitrary system commands via CREATE ALIAS (pre-auth RCE).","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://github.com/fangtang7/CVE/blob/main/Northstar%20H2/rce.md","tags":[]},{"url":"https://github.com/fangtang7/CVE/blob/main/Northstar%20H2/rce.md","tags":[]}],"exploitRefs":[{"url":"https://github.com/fangtang7/CVE/blob/main/Northstar%20H2/rce.md","tags":[]},{"url":"https://github.com/fangtang7/CVE/blob/main/Northstar%20H2/rce.md","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows any network-reachable attacker to execute arbitrary system commands via the H2 Console due to lack of authentication, posing a critical risk.","exploitability":"Exploitation is straightforward given network reachability, requiring no user interaction.","blast_radius":"If exploited, the impact could be severe, potentially leading to full system compromise.","remediation":"Upgrade to Northstar version 9.1.2 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","auth-bypass","web"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-07T08:42:52.996Z"}}