CVE-2026-19826

Name of the Vulnerable Software and Affected Versions alldatacenter alldata versions prior to 0.6.9

Description A remote deserialization issue exists within the xxl-rpc Listener component, specifically in the Hessian2Input.readObject() function located in the /serialize/impl/HessianSerializer.java file. Deserialization occurs when untrusted data is processed, potentially allowing a remote attacker to execute unauthorized actions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict access to the Hessian2Input.readObject() function within the xxl-rpc Listener component.