CVE-2026-97878

Deferred Deferred - Pending Action

Authentication Bypass in StarTraining via Druid Console

Publication date: 2026-09-25

Last updated on: 2026-09-28

Assigner: VulDB

Description

A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Impacted is the function anonymous of the file /druid/index.html of the component Druid Console. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-28

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-97878

EUVD

EUVD-2026-87235

Affected Vendors & Products

Vendor	Product	Version / Range
zhistaredu	startraining	to 3.8.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability is in zhistaredu StarTraining up to version 3.8.1. It affects the anonymous function in the Druid Console's /druid/index.html file, allowing missing authentication. The issue can be exploited remotely and a public exploit is available. The vendor did not respond to the disclosure.

Detection Guidance

Check if the Druid Console is accessible without authentication by attempting to access /druid/index.html. Use network scanning tools like nmap to identify exposed instances of StarTraining up to version 3.8.1.

Impact Analysis

An attacker could exploit this to gain unauthorized access to the Druid Console without authentication. This may lead to data breaches, unauthorized actions, or system compromise depending on the console's permissions and data.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Immediately restrict access to the Druid Console by blocking external connections to /druid/index.html. Update StarTraining to the latest version if available. If no update exists, consider disabling the affected component or implementing strict authentication measures.

Hi! I’m here to help you understand CVE-2026-97878. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70