Live › vulnerability › CVE-2026-114057
Go to dashboardArcadeDB's Bolt protocol handler does not check authorization for SHOW DATABASES, so a user with credentials for one database can see the names of every database on the server. The exposed names can reveal tenant or project identifiers, but the flaw does not give access to the data inside those databases.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running ArcadeDB 26.2.1 through 26.10.0 that expose the Bolt port to users with credentials for some databases, typically multi-tenant deployments that hold several customers or projects in one server. Single-tenant deployments, or deployments where only trusted users can reach Bolt, have little practical exposure.
No product ranges from the sources yet.
26.2.1 up to but not including 26.10.126.10.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that allows authenticated users to enumerate all database names. Attackers with credentials for any single database can issue a SHOW DATABASES query over the Bolt port to reveal unauthorized database names, exposing tenant or project identifiers.
This page as .md · .json · in your agent: get_signal("CVE-2026-114057")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.