medium · CVSS v3 4.3

CVE-2026-114057

ArcadeDB versions 26.2.1 through 26.10.0 allow authenticated users to enumerate all database names via the Bolt protocol, exposing tenant or

Overview

ArcadeDB versions 26.2.1 through 26.10.0 allow authenticated users to enumerate all database names via the Bolt protocol, exposing tenant or project identifiers. The missing authorization flaw can be triggered with a simple SHOW DATABASES query. This vulnerability is present in the Bolt handler and can be exploited by any user with database credentials.

Description

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that allows authenticated users to enumerate all database names. Attackers with credentials for any single database can issue a SHOW DATABASES query over the Bolt port to reveal unauthorized database names, exposing tenant or project identifiers.

Impact

Confidentiality: Unauthorized disclosure of database names and tenant identifiers. Integrity: No direct impact. Availability: No impact. Defenders should note that any authenticated user can enumerate databases, potentially leaking sensitive project information.

Remediation

Upgrade to ArcadeDB 26.10.1 or later where the Bolt protocol handler enforces proper authorization. If an upgrade is not immediately possible, restrict Bolt port access to trusted hosts, enforce least privilege on database credentials, and monitor for SHOW DATABASES queries. Consider disabling the Bolt protocol if it is not required for your environment.

Risk context

Severity is medium (CVSS 4.3). No EPSS data is available. The flaw is exploitable by any authenticated user, so defenders should treat it as a moderate risk that could expose tenant identifiers.

Affected products

  • ArcadeDB 26.2.1-26.10.0

Scores

Severity
medium
CVSS v2
4
CVSS v3
4.3
CVSS v4
—
EPSS
—

ArcadeDB Bolt Authorization DatabaseEnumeration Medium Confidentiality TenantID

← All CVEs

Related CVEs

medium

CVE-2026-114088

Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READY_FOR_EXECUTION to retrieve decrypted run environment variables or send TASK_RUN_FAILED_TO_RUN and similar events to tamper with arbitrary runs.

View analysis

medium

CVE-2026-114054

vLLM before 0.31.0 contains a cache aliasing flaw that lets authenticated users collide cache keys via EXIF ImageID or cache_salt, potentially leaking cached media or reusing KV state. The vulnerability can be exploited by supplying crafted values in image metadata or LoRA names. It affects all deployments of vLLM older than 0.31.0.

View analysis

medium

CVE-2026-114056

ArcadeDB versions 26.8.1 to 26.10.0 contain an authorization bypass that lets read‑only users alter edge type schema flags without UPDATE_SCHEMA rights. This change persists across restarts and can affect data integrity.

View analysis

medium

CVE-2026-114058

ArcadeDB versions 26.2.1 through 26.10.0 have a missing authorization check in the Bolt protocol. Authenticated users can read schema metadata of other databases by manipulating the db field in RUN or BEGIN messages. This allows enumeration of unauthorized schemas.

View analysis