{"id":"CVE-2026-114057","kind":"vulnerability","aliases":["CVE-2026-114057"],"related":[],"title":"ArcadeDB: Bolt handler lets any logged-in user list all database names","description":"ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that allows authenticated users to enumerate all database names. Attackers with credentials for any single database can issue a SHOW DATABASES query over the Bolt port to reveal unauthorized database names, exposing tenant or project identifiers.","summary":"ArcadeDB's Bolt protocol handler does not check authorization for SHOW DATABASES, so a user with credentials for one database can see the names of every database on the server. The exposed names can reveal tenant or project identifiers, but the flaw does not give access to the data inside those databases.","severity":"medium","cvss":5.3,"epss":0.00204,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arcadedb","bolt","multi-tenant","package","self-hosted"],"not_affected_if":["bolt-port-not-exposed","single-tenant"],"how_to_check":"- Check the running ArcadeDB version and whether it is in the range `26.2.1` up to but not including `26.10.1`\n- Check whether the Bolt port is reachable by users who hold credentials for only one database","fix":"- Upgrade ArcadeDB to `26.10.1` or later","status":"open","published_at":"2026-10-21T01:17:28+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T04:22:24+00:00","updated_at":"2026-10-25T04:22:24+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:22:24Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade ArcadeDB to `26.10.1` or later","reach":"network","title":"ArcadeDB: Bolt handler lets any logged-in user list all database names","impact":"low","summary":"ArcadeDB's Bolt protocol handler does not check authorization for SHOW DATABASES, so a user with credentials for one database can see the names of every database on the server. The exposed names can reveal tenant or project identifiers, but the flaw does not give access to the data inside those databases.","category":"package","nicknames":[],"who_cares":["arcadedb","self-hosted","multi-tenant","bolt"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker learns names of other databases on the server","analyst_note":"","how_to_check":"- Check the running ArcadeDB version and whether it is in the range `26.2.1` up to but not including `26.10.1`\n- Check whether the Bolt port is reachable by users who hold credentials for only one database","needs_analyst":false,"not_affected_if":["single-tenant","bolt-port-not-exposed"],"who_is_affected":"Teams running ArcadeDB 26.2.1 through 26.10.0 that expose the Bolt port to users with credentials for some databases, typically multi-tenant deployments that hold several customers or projects in one server. Single-tenant deployments, or deployments where only trusted users can reach Bolt, have little practical exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000603,"input_tokens":3391,"output_tokens":528,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114057':16A,19A '-2026':15A,18A '26.10.1':85C '26.2.1':83C 'access':74B 'allow':97C 'arcadedb':1A,20B,29B,81C 'attack':105C 'authent':98C 'author':37B,89C 'bolt':2A,21B,31B,93C,120C 'check':36B 'contain':86C 'credenti':45B,107C 'cve':14A,17A 'data':77B 'databas':12A,40B,48B,55B,80B,103C,111C,116C,125C 'enumer':101C 'everi':54B 'expos':60B,127C 'flaw':70B 'give':73B 'handler':3A,33B,95C 'host':28B 'identifi':67B,131C 'insid':78B 'issu':113C 'let':4A 'list':10A 'log':7A 'logged-in':6A 'miss':88C 'multi':23B 'multi-ten':22B 'name':13A,52B,61B,104C,126C 'one':47B 'packag':25B 'port':121C 'project':66B,130C 'protocol':32B,94C 'queri':117C 'reveal':63B,123C 'see':50B 'self':27B 'self-host':26B 'server':58B 'show':39B,115C 'singl':110C 'tenant':24B,64B,128C 'unauthor':124C 'user':9A,43B,99C 'vulner':90C","nicknames":[],"mitigations":[],"who_affected":"Teams running ArcadeDB 26.2.1 through 26.10.0 that expose the Bolt port to users with credentials for some databases, typically multi-tenant deployments that hold several customers or projects in one server. Single-tenant deployments, or deployments where only trusted users can reach Bolt, have little practical exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114057","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114057","severity":null,"published_at":"2026-10-21T01:17:28+00:00","modified_at":"2026-10-22T19:17:36+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114057","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114057","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}