CVE-2026-114057

MEDIUM 4.3

ArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Information Disclosure

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that allows authenticated users to enumerate all database names. Attackers with credentials for any single database can issue a SHOW DATABASES query over the Bolt port to reveal unauthorized database names, exposing tenant or project identifiers.

CWE	CWE-862
Vendor	arcadedata
Product	arcadedb
Published	Oct 21, 2026

Stay Ahead of the Next One

Get instant alerts for arcadedata arcadedb

Be the first to know when new medium vulnerabilities affecting arcadedata arcadedb are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

ArcadeData / arcadedb

26.2.1 < 26.10.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-7fcg-pg8x-wf7w vulncheck.com: https://www.vulncheck.com/advisories/arcadedb-26.2.1-before-26.10.1-bolt-show-databases-information-disclosure

Credits

🔍 manus-pi 🔍 manus-use