External risk intelligence

Super Diamond Server Configuration Service Authentication Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-75329

The vulnerability exists in a configuration distribution service listening on a dedicated network port (8283). Such services are commonly deployed in network-accessible environments to facilitate centralized configuration management across distributed systems, making them reachable as an edge or service endpoint.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects a configuration distribution service within super-diamond-server, which lacks authentication. This means an attacker could potentially access sensitive project configurations, such as database passwords and API keys, by simply sending a network request. This could have significant implications for data security and system integrity if the affected service is exposed.

Unauthenticated access to sensitive project settings.
Protects critical information like database passwords.
Verify if this configuration service is exposed externally.

Attack Path

How an attacker could exploit the issue

An attacker could remotely access the Netty configuration distribution service without needing any credentials. By sending a simple TCP request to port 8283, they can retrieve sensitive project configurations, such as database passwords and API keys. This exposure could lead to further compromise of the system and data.

No authentication required for access.
TCP request to port 8283 triggers vulnerability.
Full project configuration, including secrets, exposed.

Live Threat

Current exploitation, exposure, and threat context

The Netty configuration distribution service, when accessible over a network, could expose sensitive project configurations, including database passwords and API keys, to unauthenticated attackers. This exposure can occur when an attacker sends a direct TCP request to the service without needing any credentials.

Project configurations and secrets.
Unauthenticated TCP requests.
Unauthorized access to sensitive data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Netty configuration distribution service requires immediate attention from teams responsible for application security and infrastructure. The first practical step is to identify all instances of the affected super-diamond-server, determine their network reachability and business criticality, and then confirm the accountable owner for remediation. This will allow for a risk-based approach to planning the necessary actions.

Application owners and security teams should lead.
Verify network exposure and critical assets.
Plan risk-based remediation and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is super-diamond-server?

Super-diamond-server is a platform used for centralized configuration management. It allows developers to store and distribute settings across various software projects. By using a service built on Netty, it helps teams maintain consistent parameters, such as database credentials and API keys, across distributed environments.

Why does CVE-2026-75329 cause a security risk?

This CVE involves a missing authentication weakness, categorized as CWE-306. In plain terms, the software fails to verify the identity of anyone connecting to it. Because the configuration service lacks this security check, it treats any incoming request as legitimate, allowing unauthorized parties to read sensitive project data.

How is this vulnerability triggered?

An attacker triggers this issue by sending a direct TCP request to port 8283 on an affected server. No special commands, complex exploits, or authentication tokens are needed to initiate the connection. The vulnerability does not require user interaction, such as clicking a link or logging in, to expose the stored configurations.

Is my instance of super-diamond-server at risk?

According to Halo Surface Signal, this service is often deployed in network-accessible environments to support distributed systems. If your instance is reachable over a network—particularly if it is exposed as an edge or service endpoint—the risk is significantly higher because external parties could reach the service on port 8283.

What should I do if I run this software?

Your first step is to locate all instances of super-diamond-server within your environment. Verify whether these servers are accessible from outside your local network. Once identified, document the business criticality of each instance and coordinate with the appropriate system owners to plan and implement security controls or necessary updates.

References

github.com/fangtang7/CVE/blob/main/super-diamond/NETTY-NOAUTH.md

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.