{"id":"CVE-2026-81190","kind":"vulnerability","aliases":["CVE-2026-81190"],"related":[],"title":"KurrentDB: read-only users can read server files via secondary indexing","description":"KurrentDB is a database engineered for modern software applications and event-driven architectures. In version 26.1.0, a user authorized to read the $all stream can use Secondary Indexing query capabilities to read arbitrary files accessible to the database process, enumerate directories, and issue HTTP GET requests from that process. The default configuration limits this privilege to administrators. The flaw does not permit file writes and does not expose environment variables. This issue is fixed in version 26.1.1.","summary":"KurrentDB 26.1.0 lets a user who can read the $all stream abuse Secondary Indexing queries to read arbitrary files the database process can access, list directories, and send HTTP GET requests from the server. The default configuration restricts this capability to administrators, and the flaw does not allow file writes or expose environment variables.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","kurrentdb","package","self-hosted"],"not_affected_if":["admin-only-read-access","default-config","other-versions"],"how_to_check":"- Check the running KurrentDB version, and treat `26.1.0` as affected.\n- Check whether any non-admin accounts have read access to the `$all` stream, since the default configuration limits this to administrators.\n- Check whether Secondary Indexing is enabled on the instance.","fix":"- Upgrade KurrentDB to `26.1.1` or later.","status":"open","published_at":"2026-11-05T21:18:54+00:00","first_seen_at":"2026-11-05T21:40:45+00:00","triaged_at":"2026-11-05T21:41:13+00:00","updated_at":"2026-11-05T21:41:13+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T21:41:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade KurrentDB to `26.1.1` or later.","reach":"network","title":"KurrentDB: read-only users can read server files via secondary indexing","impact":"medium","summary":"KurrentDB 26.1.0 lets a user who can read the $all stream abuse Secondary Indexing queries to read arbitrary files the database process can access, list directories, and send HTTP GET requests from the server. The default configuration restricts this capability to administrators, and the flaw does not allow file writes or expose environment variables.","audience":"businesses","category":"package","nicknames":[],"who_cares":["kurrentdb","self-hosted","database"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated reader reads server files and makes outbound HTTP requests","analyst_note":"","how_to_check":"- Check the running KurrentDB version, and treat `26.1.0` as affected.\n- Check whether any non-admin accounts have read access to the `$all` stream, since the default configuration limits this to administrators.\n- Check whether Secondary Indexing is enabled on the instance.","plain_action":"","needs_analyst":false,"not_affected_if":["default-config","admin-only-read-access","other-versions"],"who_is_affected":"Teams running KurrentDB 26.1.0 where non-administrative users can read the $all stream. The default configuration limits this to administrators, so exposure depends on custom permissions. Instances on other versions are not covered by this advisory.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000708,"input_tokens":4310,"output_tokens":554,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-81190':15A,18A '26.1.0':26B,95C '26.1.1':156C 'abus':36B 'access':48B,114C 'administr':66B,136C 'allow':72B 'applic':87C 'arbitrari':42B,112C 'architectur':92C 'author':98C 'capabl':64B,109C 'configur':61B,131C 'cve':13A,16A 'databas':19B,45B,82C,117C 'default':60B,130C 'directori':50B,120C 'driven':91C 'engin':83C 'enumer':119C 'environ':77B,148C 'event':90C 'event-driven':89C 'expos':76B,147C 'file':9A,43B,73B,113C,142C 'fix':153C 'flaw':69B,138C 'get':54B,124C 'host':24B 'http':53B,123C 'index':12A,38B,107C 'issu':122C,151C 'kurrentdb':1A,20B,25B,79C 'let':27B 'limit':132C 'list':49B 'modern':85C 'packag':21B 'permit':141C 'privileg':134C 'process':46B,118C,128C 'queri':39B,108C 'read':3A,7A,32B,41B,100C,111C 'read-on':2A 'request':55B,125C 'restrict':62B 'secondari':11A,37B,106C 'self':23B 'self-host':22B 'send':52B 'server':8A,58B 'softwar':86C 'stream':35B,103C 'use':105C 'user':5A,29B,97C 'variabl':78B,149C 'version':94C,155C 'via':10A 'write':74B,143C","nicknames":[],"mitigations":[],"who_affected":"Teams running KurrentDB 26.1.0 where non-administrative users can read the $all stream. The default configuration limits this to administrators, so exposure depends on custom permissions. Instances on other versions are not covered by this advisory.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","kurrentdb","medium","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-07-22T09:26:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-81190","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81190","severity":null,"published_at":"2026-11-05T21:18:54+00:00","modified_at":"2026-11-05T21:18:54+00:00","first_seen_at":"2026-11-05T21:40:45+00:00","fetched_at":"2026-11-05T21:40:45+00:00","note":null}],"documents":[{"id":80391,"url":"https://github.com/kurrent-io/KurrentDB/commit/18706d0d5fcec5e2fbb0d20f76638d113b5842c8","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":80392,"url":"https://github.com/kurrent-io/KurrentDB/releases/tag/v26.1.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":80393,"url":"https://github.com/kurrent-io/KurrentDB/security/advisories/GHSA-r8vq-5875-cq97","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-22T09:26:27+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}