Live › vulnerability › CVE-2026-114058
Go to dashboardArcadeDB's Bolt protocol handler does not check authorization when a request names a database, so a user with credentials for one database can read schema metadata of others. An attacker gets table and index names and structure, not the stored rows.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments running ArcadeDB from before that expose the Bolt protocol and have more than one database with users who hold credentials on only some of them. Single-database instances and deployments without Bolt enabled have less exposure. unknown whether the sources list a specific default configuration.
26.2.126.10.1No product ranges from the sources yet.
26.10.1.26.10.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metadata. Attackers with credentials for one database can set the db field in RUN or BEGIN messages and call db.labels() or SHOW INDEXES to enumerate unauthorized schemas.
This page as .md · .json · in your agent: get_signal("CVE-2026-114058")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.