---
id: "CVE-2026-114058"
kind: "vulnerability"
aliases: ["CVE-2026-114058"]
title: "ArcadeDB: Bolt handler lets logged-in users read other databases' schema"
severity: "medium"
cvss: 5.3
epss: 0.00204
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["arcadedb", "database", "package", "self-hosted"]
not_affected_if: ["bolt-disabled", "single-database", "versions-outside-range"]
published_at: "2026-10-21T01:17:28+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T04:22:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114058", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114058", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# ArcadeDB: Bolt handler lets logged-in users read other databases' schema

ArcadeDB's Bolt protocol handler does not check authorization when a request names a database, so a user with credentials for one database can read schema metadata of others. An attacker gets table and index names and structure, not the stored rows.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the ArcadeDB version with the server's version output or the release in the deployment, and compare it to `26.10.1`.
- Confirm whether the Bolt protocol endpoint is enabled in the server configuration.

## Fix

- Upgrade ArcadeDB to `26.10.1` or later.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114058
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114058

## From the sources

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metadata. Attackers with credentials for one database can set the db field in RUN or BEGIN messages and call db.labels() or SHOW INDEXES to enumerate unauthorized schemas.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_