External risk intelligence

Unauthenticated Database Table Export Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-71379

The vulnerability exists in a file export endpoint accessible via a POST request without authentication. Because this is a web-based application endpoint that does not require user authentication, it is commonly deployed as a network-accessible service reachable from the internet.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a file export feature that allows any unauthenticated attacker to export arbitrary database tables. This issue impacts web-based applications and could potentially lead to unauthorized access and exfiltration of sensitive information due to its network accessibility and lack of authentication requirements.

Unauthenticated access to all database tables.
Protects sensitive data from unauthorized export.
Confirm exposure and assess data sensitivity.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can access a file export feature on the network to retrieve sensitive data from database tables. This feature is exposed via a POST request, and when successful, can lead to broad system compromise.

Accessible via network.
Triggered by crafted POST request.
High risk of data exposure.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to access and export any database table through a specially crafted POST request to the file export endpoint. This could expose sensitive information or system data, depending on what is stored in the database and what tables are accessible.

Database tables and their contents.
Unauthenticated POST request to endpoint.
Exposure of sensitive or system data.

Operational Fix

Recommended remediation, mitigation, and detection steps

The file export endpoint's unauthenticated access to arbitrary database tables suggests that the application owner and the platform or infrastructure team are key stakeholders. The initial step involves identifying all instances of this application, assessing their exposure and criticality, and confirming the accountable owner for each. This groundwork is crucial for prioritizing and planning effective remediation efforts.

Application owners and platform teams.
Verify instance reachability and business criticality.
Plan and coordinate targeted remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the software affected by CVE-2026-71379?

This vulnerability affects web-based applications that include a file export feature. This functionality is typically used to extract, download, or report on data stored within the system's backend databases. The defect resides specifically within an endpoint designed to handle these export requests.

What does CWE-552 mean for this vulnerability?

CWE-552, or Improper Neutralization of Directives in Files or Directories, identifies a weakness where an application allows unauthorized access to files or resources. In the context of CVE-2026-71379, it means the system fails to restrict access to database tables, allowing an attacker to request and retrieve data that should be protected or hidden from public view.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specifically crafted POST request to the application's file export endpoint. Importantly, this action does not require any credentials, login sessions, or prior authorization. Simply navigating to the site or viewing a page does not trigger it; it requires an intentional, malicious request aimed at the export function.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates that because the export endpoint is web-based and requires no authentication, it is often deployed in ways that are reachable from the public internet. If your instance is exposed to the network or the internet, it is at higher risk of being reached by an attacker without needing to bypass any initial security checks.

How should I respond to CVE-2026-71379?

Begin by identifying all running instances of the affected application across your infrastructure. Coordinate with the platform teams to verify if these instances are network-accessible and determine the sensitivity of the data stored in the connected databases. This helps you prioritize which systems require the most urgent attention and planning for remediation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.