The Netty configuration distribution service exposed on TCP port 8283 in super-diamond-server has no authentication mechanism. By simply connecting to the service over TCP, an attacker can retrieve the full configuration of any project, which may contain database passwords, API keys, or other sensitive information. This vulnerability directly compromises confidentiality and can provide an attacker with additional footholds for further exploitation.

Super‑diamond‑server deployments that expose the Netty configuration distribution service on port 8283 and run any version equal to or lower than 1.3.3 are affected. The issue is confined to the Netty component of super-diamond-server; no other vendors or products are indicated as impacted.

The EPSS score is unavailable, yet the vulnerability is trivial to exploit: an unauthenticated network connection to the open port reveals private data. The CVE is not listed in CISA KEV, indicating no known widespread exploitation to date. Nonetheless, the lack of authentication combined with the sensitivity of the disclosed data suggests a high residual risk. Any host that can reach the service can easily obtain the configuration unless network isolation or firewall rules are enforced.