The Netty configuration distribution service exposed on TCP port 8283 in super‑diamond‑server has no authentication mechanism, a flaw identified as a lack of authentication (CWE‑306). By simply connecting to the service over TCP, an attacker can retrieve the full configuration of any project, which may contain database passwords, API keys, or other sensitive information. This vulnerability directly compromises confidentiality and can provide an attacker with additional footholds for further exploitation.

Super‑diamond‑server deployments that expose the Netty configuration distribution service on port 8283 and run any version equal to or lower than 1.3.3 are affected. The issue is confined to the Netty component of super‑diamond‑server; no other vendors or products are indicated as impacted.

The EPSS score is < 1%, which indicates a low exploitation likelihood, but the CVSS score of 9.8 highlights a severe risk with complete confidentiality loss. The vulnerability is trivial to exploit: an unauthenticated network connection to the open TCP port 8283 reveals private configuration data. The CVE is not listed in CISA KEV, indicating no known widespread exploitation to date. Nonetheless, the lack of authentication combined with the sensitivity of the disclosed data suggests a high residual risk. Any host that can reach the service can easily obtain the configuration unless network isolation or firewall rules are enforced.