Live › vulnerability › CVE-2026-119577
ArcadeDB before 26.10.2 does not drop access for users whose rights were revoked when they already hold an open Postgres, Bolt, MongoDB, or Redis wire-protocol connection. A user with such a connection can keep reading and writing data after their account is deleted, their grants are removed, or their password is rotated.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 14:30 UTC. All times on this page are UTC.
Teams running ArcadeDB before 26.10.2 with the Postgres, Bolt, MongoDB, or Redis wire-protocol endpoints in use, where users are granted and revoked access. Exposure depends on users holding long-lived connections that outlive a revocation or password change. Deployments on a version at or after 26.10.2, or that do not expose these protocols, are not affected.
No product ranges from the sources yet.
26.10.2.26.10.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDB, or Redis wire-protocol connections. Attackers holding an existing connection can keep reading and writing data after deletion, grant removal, or password rotation, because executors keep a stale ServerSecurityUser.
This page as .md · .json · in your agent: get_signal("CVE-2026-119577")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.