CVE-2026-88391
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Northstar（dromara/northstar，量化交易平台）<= 9.1.1 版本中启用了 H2 Console，但其身份认证拦截器仅覆盖 /northstar/** 路径，导致 /h2-console 接口暴露在无认证访问的情况下。该版本嵌入的 H2 数据库使用默认用户名 "sa" 且密码为空。任何可通过网络访问的攻击者均可利用 CREATE ALIAS 语句执行任意系统命令，构成认证前远程代码执行漏洞（pre-auth RCE）。
Possible ATT&CK Techniques 3 AI
T1078 · Valid Accounts T1136 · Create Account T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-88391
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/**, so /h2-console is exposed with no authentication and the embedded H2 DB uses default sa / empty password. Any network-reachable attacker can run arbitrary system commands via CREATE ALIAS (pre-auth RCE).
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2026-88391
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-88391
请登录查看更多情报信息。
Other References for CVE-2026-88391 (1)
Same Patch Batch · n/a · 2026-10-05 · 18 CVEs total
| CVE-2026-105307 | 7.3 HIGH | Casdoor API Endpoint authz_filter.go ApiFilter missing authentication |
| CVE-2026-105329 | 6.3 MEDIUM | TallCMS PluginManager ThemeManager.php code injection |
| CVE-2026-105251 | 6.3 MEDIUM | vgmstream VAG File psx_decoder.c ps_find_padding out-of-bounds |
| CVE-2026-105180 | 6.3 MEDIUM | Jeebase UserService info updateUser dynamically-determined object attributes |
| CVE-2026-105248 | 6.3 MEDIUM | vgmstream TXTP File txtp_parser.c txtp_parse out-of-bounds write |
| CVE-2026-105174 | 5.4 MEDIUM | Gerapy Project Management views.py project_create path traversal |
| CVE-2026-105249 | 4.8 MEDIUM | vgmstream TXTP File txtp_process.c make_group_random use after free |
| CVE-2026-105315 | 4.7 MEDIUM | django-haystack more_like_this Template Tag elasticsearch_backend.py _to_python eval injec |
| CVE-2026-105263 | 4.7 MEDIUM | Shaarli Admin Metadata Endpoint MetadataController.php MetadataController server-side requ |
| CVE-2026-105250 | 4.3 MEDIUM | vgmstream Microsoft IMA Decoder ima_decoder.c decode_ms_ima divide by zero |
| CVE-2026-88394 | WookTeam v1.6.6及以前版本目录遍历漏洞 | |
| CVE-2026-88392 | Unimall v4文件上传目录遍历致任意代码执行 | |
| CVE-2026-37719 | dormakaba evolo Service任意版本.NET组件远程代码执行漏洞 | |
| CVE-2026-88393 | WookTeam v1.6.6前版本导出接口存在RCE漏洞 | |
| CVE-2026-88395 | GouGuOA v6.0.5及之前版本SQL注入漏洞 | |
| CVE-2026-88397 | ApiAdmin<=5.0 用户列表接口存在SQL注入漏洞 | |
| CVE-2026-88396 | ApiAdmin<=v5.0目录遍历致远程代码执行 |
IV. Related Vulnerabilities
Same vendor: n/a
-
CVE-2026-105329
TallCMS PluginManager ThemeManager.php code injection -
CVE-2026-105315
django-haystack more_like_this Template Tag elasticsearch_ba -
CVE-2026-105307
Casdoor API Endpoint authz_filter.go ApiFilter missing authe -
CVE-2026-105263
Shaarli Admin Metadata Endpoint MetadataController.php Metad -
CVE-2026-105251
vgmstream VAG File psx_decoder.c ps_find_padding out-of-boun
V. Comments for CVE-2026-88391
No comments yet