CVE-2026-81190 · Package
NO FIX YET · SEE WHAT TO DO
KurrentDB 26.1.0 lets a user who can read the $all stream abuse Secondary Indexing queries to read arbitrary files the database process can access, list directories, and send HTTP GET requests from the server. The default configuration restricts this capability to administrators, and the flaw does not allow file writes or expose environment variables.
first public Jul 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running KurrentDB 26.1.0 where non-administrative users can read the $all stream. The default configuration limits this to administrators, so exposure depends on custom permissions. Instances on other versions are not covered by this advisory.
Not affected if admin-only-read-access, default-config, other-versions
Who cares database, kurrentdb, self-hosted
26.1.0 as affected.$all stream, since the default configuration limits this to administrators.26.1.1 or later.KurrentDB is a database engineered for modern software applications and event-driven architectures. In version 26.1.0, a user authorized to read the $all stream can use Secondary Indexing query capabilities to read arbitrary files accessible to the database process, enumerate directories, and issue HTTP GET requests from that process. The default configuration limits this privilege to administrators. The flaw does not permit file writes and does not expose environment variables. This issue is fixed in version 26.1.1.
This page as .md ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.