CVE-2026-88391 Code injection in n/a
Attackers can execute arbitrary system commands via the exposed H2 Console due to missing authentication and default credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-88391?
CVE-2026-88391 is a critical code injection vulnerability in n/a, published on 5 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/**, so /h2-console is exposed with no authentication and the embedded H2 DB uses default sa / empty password. Any network-reachable attacker can run arbitrary system commands via CREATE ALIAS (pre-auth RCE).
Weakness: CWE-94
Which versions are affected by CVE-2026-88391?
How do I fix CVE-2026-88391?
No fix has been published for CVE-2026-88391 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-88391 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-88391 exists.
Sources
Also known as GHSA-8hhc-85h8-34q6.