This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
- ๐จ **CVE-2026-42072**: NornicDB Bolt Server binds to all interfaces by default.
>- Even with config set, **Bolt port** listens on `0.0.0.0`.
>- ๐ Exposes DB & **default admin:password** in LAN.โฆ
- ๐ ๏ธ **Root Cause**: Config not passed to Bolt server.
>- `--address` & env vars work for HTTP โ but NOT for Bolt โ.
>- ๐งฑ Likely **CWE-400**: Uncontrolled Resource Consumption / Exposure.โฆ
- ๐ฏ **Affected**: NornicDB versions **< 1.0.42-hotfix**.
>- ๐ฆ Component: **Bolt Server** (graph traversal & write API).
>- ๐ฅ๏ธ Any OS running vulnerable version in LAN.
Q4What can hackers do? (Privileges/Data)
- ๐ต๏ธ **Attackers** in LAN can:
> - ๐ Login via **admin/password**.
> - ๐ Read/modify **graph & vector data**.
> - โ๏ธ Execute **write ops & traversals**.
>- ๐ **Privilege**: Full control (no auth needed).
Q5Is exploitation threshold high? (Auth/Config)
- ๐ข **Exploitation threshold LOW**.
>- ๐ช No auth needed.
>- ๐ Just need LAN access.
>- โ๏ธ Works even if user tried to restrict binding.
Q6Is there a public Exp? (PoC/Wild Exploitation)
- ๐ **No public PoC** listed.
>- `pocs`: empty.
>- โ Not marked as exploited in wild (per data).
>- ๐ But risk still HIGH due to simplicity.
Q7How to self-check? (Features/Scanning)
- ๐งช **Self-check steps**:
> - Run `netstat -tulnp` or `ss -ltnp`.
> - Check if Bolt port (default?) binds to `0.0.0.0`.
> - โ Confirm version < 1.0.42-hotfix.โฆ