---
id: "CVE-2026-81190"
page: "https://infrastack.ai/live/CVE-2026-81190"
kind: "vulnerability"
aliases: ["CVE-2026-81190"]
title: "KurrentDB: read-only users can read server files via secondary indexing"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["database", "kurrentdb", "package", "self-hosted"]
not_affected_if: ["admin-only-read-access", "default-config", "other-versions"]
published_at: "2026-11-05T21:18:54+00:00"
first_seen_at: "2026-11-05T21:40:45+00:00"
updated_at: "2026-11-05T21:41:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81190", "first_seen_at": "2026-11-05T21:40:45+00:00"}]
exploit_sources: []
---

# KurrentDB: read-only users can read server files via secondary indexing

Link for people: https://infrastack.ai/live/CVE-2026-81190 (this .md is for agents)

KurrentDB 26.1.0 lets a user who can read the $all stream abuse Secondary Indexing queries to read arbitrary files the database process can access, list directories, and send HTTP GET requests from the server. The default configuration restricts this capability to administrators, and the flaw does not allow file writes or expose environment variables.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the running KurrentDB version, and treat `26.1.0` as affected.
- Check whether any non-admin accounts have read access to the `$all` stream, since the default configuration limits this to administrators.
- Check whether Secondary Indexing is enabled on the instance.

## Fix

- Upgrade KurrentDB to `26.1.1` or later.

## Timeline

- 2026-11-05T21:40:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-81190

## Documents

- [advisory] Vendor advisory: github.com https://github.com/kurrent-io/KurrentDB/security/advisories/GHSA-r8vq-5875-cq97
- [fix] Patch: github.com https://github.com/kurrent-io/KurrentDB/commit/18706d0d5fcec5e2fbb0d20f76638d113b5842c8
- [fix] Release notes: github.com https://github.com/kurrent-io/KurrentDB/releases/tag/v26.1.1

## From the sources

KurrentDB is a database engineered for modern software applications and event-driven architectures. In version 26.1.0, a user authorized to read the $all stream can use Secondary Indexing query capabilities to read arbitrary files accessible to the database process, enumerate directories, and issue HTTP GET requests from that process. The default configuration limits this privilege to administrators. The flaw does not permit file writes and does not expose environment variables. This issue is fixed in version 26.1.1.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_