---
id: "CVE-2026-114057"
kind: "vulnerability"
aliases: ["CVE-2026-114057"]
title: "ArcadeDB: Bolt handler lets any logged-in user list all database names"
severity: "medium"
cvss: 5.3
epss: 0.00204
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["arcadedb", "bolt", "multi-tenant", "package", "self-hosted"]
not_affected_if: ["bolt-port-not-exposed", "single-tenant"]
published_at: "2026-10-21T01:17:28+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T04:22:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114057", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114057", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# ArcadeDB: Bolt handler lets any logged-in user list all database names

ArcadeDB's Bolt protocol handler does not check authorization for SHOW DATABASES, so a user with credentials for one database can see the names of every database on the server. The exposed names can reveal tenant or project identifiers, but the flaw does not give access to the data inside those databases.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the running ArcadeDB version and whether it is in the range `26.2.1` up to but not including `26.10.1`
- Check whether the Bolt port is reachable by users who hold credentials for only one database

## Fix

- Upgrade ArcadeDB to `26.10.1` or later

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114057
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114057

## From the sources

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that allows authenticated users to enumerate all database names. Attackers with credentials for any single database can issue a SHOW DATABASES query over the Bolt port to reveal unauthorized database names, exposing tenant or project identifiers.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_