medium · CVSS v3 4.3

CVE-2026-114058

ArcadeDB versions 26.2.1 through 26.10.0 have a missing authorization check in the Bolt protocol. Authenticated users can read schema metada

Overview

ArcadeDB versions 26.2.1 through 26.10.0 have a missing authorization check in the Bolt protocol. Authenticated users can read schema metadata of other databases by manipulating the db field in RUN or BEGIN messages. This allows enumeration of unauthorized schemas.

Description

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metadata. Attackers with credentials for one database can set the db field in RUN or BEGIN messages and call db.labels() or SHOW INDEXES to enumerate unauthorized schemas.

Impact

Confidentiality: attackers can view schema definitions of databases they are not authorized to access. Integrity: no direct impact. Availability: no impact. Defenders: database administrators and security teams must ensure proper isolation and patching.

Remediation

Apply the official patch to upgrade to ArcadeDB 26.10.1 or later. If upgrade not possible, restrict Bolt protocol access to trusted hosts or enforce network segmentation. Disable or monitor the db field usage in RUN/BEGIN messages.

Risk context

The vulnerability has a medium severity score (CVSS 4.3) and no EPSS data, indicating moderate risk. Prompt patching is recommended to prevent schema enumeration.

Affected products

  • ArcadeDB

Scores

Severity
medium
CVSS v2
4
CVSS v3
4.3
CVSS v4
—
EPSS
—

ArcadeDB Bolt Authorization Schema Enumeration Medium Database Defensive

← All CVEs

Related CVEs

medium

CVE-2026-114088

Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READY_FOR_EXECUTION to retrieve decrypted run environment variables or send TASK_RUN_FAILED_TO_RUN and similar events to tamper with arbitrary runs.

View analysis

medium

CVE-2026-114054

vLLM before 0.31.0 contains a cache aliasing flaw that lets authenticated users collide cache keys via EXIF ImageID or cache_salt, potentially leaking cached media or reusing KV state. The vulnerability can be exploited by supplying crafted values in image metadata or LoRA names. It affects all deployments of vLLM older than 0.31.0.

View analysis

medium

CVE-2026-114056

ArcadeDB versions 26.8.1 to 26.10.0 contain an authorization bypass that lets read‑only users alter edge type schema flags without UPDATE_SCHEMA rights. This change persists across restarts and can affect data integrity.

View analysis

medium

CVE-2026-114057

ArcadeDB versions 26.2.1 through 26.10.0 allow authenticated users to enumerate all database names via the Bolt protocol, exposing tenant or project identifiers. The missing authorization flaw can be triggered with a simple SHOW DATABASES query. This vulnerability is present in the Bolt handler and can be exploited by any user with database credentials.

View analysis