{"id":"CVE-2026-82116","kind":"vulnerability","aliases":["CVE-2026-82116"],"related":[],"title":"HiRDB database server: missing authentication on a critical function","description":"Missing Authentication for Critical Function Vulnerability in HiRDB.\n\n\nThis issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-00 through 09-66-/V.","summary":"HiRDB, a Hitachi relational database server, lacks authentication on a critical function in several version ranges. An attacker who can reach the server can invoke that function without credentials.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","hirdb","hitachi","runtime"],"not_affected_if":["version-outside-listed-ranges"],"how_to_check":"- Check the installed HiRDB version (Server Version 10 before `10-12-01`, Server Version 9 through `09-66-22`, or the 9(32) and Additional Function variants listed in the advisory)\n- Confirm whether the HiRDB server port is reachable from untrusted networks","fix":"- Upgrade HiRDB Server Version 10 to `10-12-01` or later\n- Upgrade HiRDB Server Version 9 and the Additional Function variants to a release after `09-66-22` per the vendor advisory (unknown exact fixed build in the sources)","status":"open","published_at":"2026-10-27T10:16:55+00:00","first_seen_at":"2026-10-27T10:31:02+00:00","triaged_at":"2026-10-27T10:31:38+00:00","updated_at":"2026-10-27T10:31:38+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-27T10:31:38Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade HiRDB Server Version 10 to `10-12-01` or later\n- Upgrade HiRDB Server Version 9 and the Additional Function variants to a release after `09-66-22` per the vendor advisory (unknown exact fixed build in the sources)","reach":"network","title":"HiRDB database server: missing authentication on a critical function","impact":"high","summary":"HiRDB, a Hitachi relational database server, lacks authentication on a critical function in several version ranges. An attacker who can reach the server can invoke that function without credentials.","category":"runtime","nicknames":[],"who_cares":["hirdb","database","hitachi"],"confidence":0.5,"needs_auth":"no","worst_case":"unauthenticated attacker invokes a critical database function remotely","analyst_note":"Find the vendor advisory for CVE-2026-82116 to confirm the affected function, default configuration, and exact fixed build for HiRDB 9 and the Additional Function variants.","how_to_check":"- Check the installed HiRDB version (Server Version 10 before `10-12-01`, Server Version 9 through `09-66-22`, or the 9(32) and Additional Function variants listed in the advisory)\n- Confirm whether the HiRDB server port is reachable from untrusted networks","needs_analyst":true,"not_affected_if":["version-outside-listed-ranges"],"who_is_affected":"Sites running the listed HiRDB Server versions, especially where the database port is reachable beyond a trusted network. The sources do not describe which critical function is exposed or whether default configurations are affected, so the exact exposure is unknown. Teams on versions outside the listed ranges can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000646,"input_tokens":3384,"output_tokens":616,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-00':66C,77C,91C,118C '-01':70C '-02':103C '-12':69C '-2026':11A,14A '-22':81C,107C '-66':80C,94C,106C,121C '-82116':12A,15A '/v':95C,122C '09':76C,79C,90C,93C,102C,105C,117C,120C '10':63C,65C,68C '32':100C,115C '9':74C,88C,99C,114C 'addit':85C,111C 'affect':59C 'attack':37B 'authent':5A,27B,50C 'credenti':48B 'critic':8A,30B,52C 'cve':10A,13A 'databas':2A,16B,24B 'function':9A,31B,46B,53C,86C,112C 'hirdb':1A,17B,20B,56C,60C,71C,82C,96C,108C 'hitachi':18B,22B 'invok':44B 'issu':58C 'lack':26B 'miss':4A,49C 'rang':35B 'reach':40B 'relat':23B 'runtim':19B 'server':3A,25B,42B,61C,72C,83C,97C,109C 'sever':33B 'version':34B,62C,73C,87C,98C,113C 'vulner':54C 'without':47B","nicknames":[],"mitigations":[],"who_affected":"Sites running the listed HiRDB Server versions, especially where the database port is reachable beyond a trusted network. The sources do not describe which critical function is exposed or whether default configurations are affected, so the exact exposure is unknown. Teams on versions outside the listed ranges can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T10:16:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"hirt@hitachi.co.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82116","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82116","severity":null,"published_at":"2026-10-27T10:16:55+00:00","modified_at":"2026-10-27T10:16:55+00:00","first_seen_at":"2026-10-27T10:31:02+00:00","fetched_at":"2026-10-27T10:31:02+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}