Northstar: Unauthenticated remote code execution via exposed H2 console
Summary
Northstar up to version 9.1.1 enables the H2 database console, but the authentication interceptor only protects /northstar/**, leaving /h2-console accessible without login. The embedded H2 database uses the default sa account with an empty password. An unauthenticated network attacker can create a SQL alias that runs operating system commands on the server, which is a pre-authentication remote code execution. The condition is that the /h2-console path is reachable over the network.
Affected
- Northstar (dromara/northstar) up to and including 9.1.1
- Condition: /h2-console is reachable (enabled in dev and prod profiles, server binds all interfaces)
Fixed in
Unknown. No vendor advisory or patched version has been found at the time of writing.
Workaround
- Block /h2-console at the reverse proxy, WAF or firewall and do not expose it to the internet
- Disable the H2 console in the application configuration (not verified for Northstar)
- Set a strong password for the sa account or remove its default access
- Review the H2 database for unexpected aliases and check logs for requests to /h2-console
Exploitation
- CISA SSVC: exploitation status poc, automatable yes, technical impact total
- A public third-party write-up with reproduction steps exists (fangtang7/CVE)
- No evidence of exploitation in the wild found; not listed in KEV
- EPSS 0.00358
Our recommendation
- Check immediately whether Northstar is in use and whether /h2-console is reachable from the internet
- Apply the workarounds above without delay, especially blocking external access
- Treat any exposed instance as potentially compromised: review logs, aliases and running processes
- Monitor the vendor's GitHub and Gitee repositories for an advisory and fixed version, then update
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linked write-up: Northstar H2 Console Unauthenticated RCE (fangtang7/CVE) github.com
- Strix CVE summary CVE-2026-88391 www.strix.ai
- Vulnrichment CVE-2026-88391 vulners.com
- CVEBrief archive 2026/10/08 cvebrief.com
- Northstar project repository github.com
- Acunetix: H2 console publicly accessible www.acunetix.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:18.
Original description (NVD)
Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/**, so /h2-console is exposed with no authentication and the embedded H2 DB uses default sa / empty password. Any network-reachable attacker can run arbitrary system commands via CREATE ALIAS (pre-auth RCE).
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.