CVE-2026-88391

{
  "etk_id": "ETK-2026-655",
  "cve_id": "CVE-2026-88391",
  "display_id": "CVE-2026-88391",
  "ghsa_id": "GHSA-8hhc-85h8-34q6",
  "euvd_id": "EUVD-2026-92443",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated H2 console exposure in dromara Northstar",
  "summary": "dromara Northstar versions through 9.1.1 expose the embedded H2 console without authentication. An attacker who can reach that endpoint over the network can access the database using default credentials and execute commands on the host.",
  "mitigation": "Disable the H2 console in deployed Northstar instances and block network access to its console endpoint. Restrict the service to trusted networks until an upstream fixed release is available.",
  "vendor": "dromara",
  "product": "Northstar",
  "affected": [
    {
      "affected_notes": [
        "n/a"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "n/a",
      "purl": null
    }
  ],
  "cwes": [
    94
  ],
  "cvss_score": 9.8,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0036,
  "epss_percentile": 0.2808,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 28.543183066666668,
  "t0_at": "2026-10-05T00:00:00+00:00",
  "signals": {
    "check": {
      "at": "2026-10-05T16:51:44.646751+00:00",
      "days": 0.7026000781365741,
      "is_lower_bound": false,
      "measured_at": "2026-10-05T00:00:00+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-05T00:00:00+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-05T00:00:00+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-88391"
    }
  }
}