CVE-2026-114058

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-114058

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114058.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-114058

Aliases

GHSA-hw9x-xx38-rg28

Published

2026-10-21T00:36:33Z

Modified

2026-10-21T10:46:28Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization via Bolt Protocol

Details

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metadata. Attackers with credentials for one database can set the db field in RUN or BEGIN messages and call db.labels() or SHOW INDEXES to enumerate unauthorized schemas.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114058.json"
}

References

Affected packages

Git / github.com/arcadedata/arcadedb

Affected ranges

Type

GIT

Repo

https://github.com/arcadedata/arcadedb

Events

Introduced

ced6531188602179fef91d7f831373e7ff47284c

Fixed

f8cd5c03647cbb1a716275620fd8b3728d9a6c6c

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "26.2.1"
                },
                {
                    "fixed":  "26.10.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Affected versions

26.*

26.2.1

26.3.1

26.3.2

26.4.2

26.5.1

26.6.1

26.7.1

26.7.2

26.9.1

Other

untagged-3026f5635164cd300b5b

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114058.json"