---
id: "CVE-2026-82117"
kind: "vulnerability"
aliases: ["CVE-2026-82117"]
title: "HiRDB: authentication bypass by spoofing lets attackers get in"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["database", "enterprise", "hirdb", "on-prem", "runtime"]
not_affected_if: ["patched-version"]
published_at: "2026-10-27T10:16:55+00:00"
first_seen_at: "2026-10-27T10:31:02+00:00"
updated_at: "2026-10-27T10:31:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82117", "first_seen_at": "2026-10-27T10:31:02+00:00"}]
---

# HiRDB: authentication bypass by spoofing lets attackers get in

HiRDB is a Hitachi relational database server, and several of its versions contain an authentication bypass caused by spoofing. An attacker who can reach the server can get past authentication without valid credentials, according to the NVD entry rated 9.8.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed HiRDB Server version against the affected ranges: 10-00 to before 10-12-01, 9-00 through 09-66-22, and the 09-66/V and 09(32) variants listed in the description.
- Confirm which HiRDB version and edition is running on each database host.

## Fix

- Upgrade HiRDB Server 10 to `10-12-01` or later, per the vendor advisory (version details from NVD; the fixed version for the 9.x branches is unknown).
- Restrict network access to the HiRDB server port to trusted hosts until patched.

## Timeline

- 2026-10-27T10:31:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-82117

## From the sources

Authentication Bypass by Spoofing Vulnerability in HiRDB.

This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-00 through 09-66-/V.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_