{"id":"CVE-2026-114058","kind":"vulnerability","aliases":["CVE-2026-114058"],"related":[],"title":"ArcadeDB: Bolt handler lets logged-in users read other databases' schema","description":"ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metadata. Attackers with credentials for one database can set the db field in RUN or BEGIN messages and call db.labels() or SHOW INDEXES to enumerate unauthorized schemas.","summary":"ArcadeDB's Bolt protocol handler does not check authorization when a request names a database, so a user with credentials for one database can read schema metadata of others. An attacker gets table and index names and structure, not the stored rows.","severity":"medium","cvss":5.3,"epss":0.00204,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arcadedb","database","package","self-hosted"],"not_affected_if":["bolt-disabled","single-database","versions-outside-range"],"how_to_check":"- Check the ArcadeDB version with the server's version output or the release in the deployment, and compare it to `26.10.1`.\n- Confirm whether the Bolt protocol endpoint is enabled in the server configuration.","fix":"- Upgrade ArcadeDB to `26.10.1` or later.","status":"open","published_at":"2026-10-21T01:17:28+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T04:22:23+00:00","updated_at":"2026-10-25T04:22:23+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:22:23Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade ArcadeDB to `26.10.1` or later.","reach":"network","title":"ArcadeDB: Bolt handler lets logged-in users read other databases' schema","impact":"low","summary":"ArcadeDB's Bolt protocol handler does not check authorization when a request names a database, so a user with credentials for one database can read schema metadata of others. An attacker gets table and index names and structure, not the stored rows.","category":"package","nicknames":[],"who_cares":["arcadedb","self-hosted","database"],"confidence":0.7,"needs_auth":"yes","worst_case":"Authenticated user enumerates schema metadata of other databases","analyst_note":"","how_to_check":"- Check the ArcadeDB version with the server's version output or the release in the deployment, and compare it to `26.10.1`.\n- Confirm whether the Bolt protocol endpoint is enabled in the server configuration.","needs_analyst":false,"not_affected_if":["single-database","bolt-disabled","versions-outside-range"],"who_is_affected":"Deployments running ArcadeDB from `26.2.1` before `26.10.1` that expose the Bolt protocol and have more than one database with users who hold credentials on only some of them. Single-database instances and deployments without Bolt enabled have less exposure. unknown whether the sources list a specific default configuration.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000592,"input_tokens":3394,"output_tokens":505,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114058':15A,18A '-2026':14A,17A '26.10.1':71C '26.2.1':69C 'arcadedb':1A,19B,25B,67C 'attack':55B,91C 'authent':84C 'author':33B,75C 'begin':105C 'bolt':2A,27B,79C 'call':108C 'check':32B 'contain':72C 'credenti':44B,93C 'cve':13A,16A 'databas':11A,20B,39B,47B,88C,96C 'db':100C 'db.labels':109C 'enumer':114C 'field':101C 'get':56B 'handler':3A,29B,81C 'host':24B 'index':59B,112C 'let':4A,83C 'log':6A 'logged-in':5A 'messag':106C 'metadata':51B,90C 'miss':74C 'name':37B,60B 'one':46B,95C 'other':53B 'packag':21B 'protocol':28B,80C 'read':9A,49B,86C 'request':36B 'row':66B 'run':103C 'schema':12A,50B,89C,116C 'self':23B 'self-host':22B 'set':98C 'show':111C 'store':65B 'structur':62B 'tabl':57B 'unauthor':115C 'user':8A,42B,85C 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":"Deployments running ArcadeDB from `26.2.1` before `26.10.1` that expose the Bolt protocol and have more than one database with users who hold credentials on only some of them. Single-database instances and deployments without Bolt enabled have less exposure. unknown whether the sources list a specific default configuration.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114058","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114058","severity":null,"published_at":"2026-10-21T01:17:28+00:00","modified_at":"2026-10-21T01:17:28+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114058","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114058","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}