CVE-2026-70557 diboot CVE debrief

Who should care

Defenders responsible for diboot-core deployments should assess exposure and prioritize remediation. Roles include security teams, DevOps, and IT personnel managing affected systems.

Why it matters

CVE-2026-70557 allows unauthorized data exposure in diboot-core deployments. Defenders should verify exposure, prioritize remediation, and monitor for potential exploitation attempts. Evidence is based on official CVE Program and NVD records.

• Potential unauthorized data exposure for all rows of any entity
• Possible disclosure of secret fields such as IamAccount.authSecret and IamAccount.secretSalt
• Trivially crackable offline admin password hashes using Shiro's two-iteration MD5 with an 8-character salt
• Potential for full administrative takeover

Technical summary

The diboot-core library contains a vulnerability in its POST /common/load-related-data endpoint, allowing unauthorized data exposure. The endpoint resolves caller-supplied field names to any @TableField column of any entity and returns those values for all rows, with no field or entity allowlist. This issue enables the exposure of secret fields such as IamAccount.authSecret and IamAccount.secretSalt for every account. Additionally, Shiro's two-iteration MD5 with an 8-character salt is trivially crackable offline, leading to potential full administrative takeover. The vulnerability is not example code and is required by the official diboot-admin-ui frontend.

Defensive priority

Defenders should prioritize verifying exposure and remediating vulnerable deployments.

Recommended defensive actions

• Verify exposure by checking for vulnerable diboot-core deployments
• Remediate vulnerable deployments by applying vendor-provided patches or mitigations
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Evidence from the CVE Program and NVD indicates that diboot-core's POST /common/load-related-data endpoint allows unauthorized data exposure. Official sources confirm the vulnerability's existence and provide details on the affected component.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.