CVE-2026-114057— ArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Information Disclosure
Quick assessment
Affected
ArcadeData arcadedb
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ArcadeDB 26.2.1 至 26.10.1 之前的版本中，Bolt 协议处理器存在授权缺失漏洞。该漏洞允许已认证用户枚举所有数据库名称。攻击者若拥有任意单个数据库的凭据，即可通过 Bolt 端口执行 SHOW DATABASES 查询，从而获取未经授权的数据库名称，进而暴露租户或项目标识符。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114057
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Information Disclosure
Source: CVE Program / CVE List V5
Vulnerability Description
ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that allows authenticated users to enumerate all database names. Attackers with credentials for any single database can issue a SHOW DATABASES query over the Bolt port to reveal unauthorized database names, exposing tenant or project identifiers.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ArcadeData | arcadedb | 26.2.1 ~ 26.10.1 | - |
|
II. Public POCs for CVE-2026-114057
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114057
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-114057 (2)
Same Patch Batch · ArcadeData · 2026-10-21 · 4 CVEs total
| CVE-2026-114059 | 7.5 HIGH | ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing Authorization |
| CVE-2026-114058 | 4.3 MEDIUM | ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization via Bolt Protocol |
| CVE-2026-114056 | 4.3 MEDIUM | ArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via ALTER TYPE WITH |
IV. Related Vulnerabilities
Same product: arcadedb
-
CVE-2026-114059
ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missin -
CVE-2026-114058
ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization vi -
CVE-2026-114056
ArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via -
CVE-2026-93598
ArcadeDB before 26.9.1 Classpath Credential Disclosure via R -
CVE-2026-93597
ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses
Same vendor: ArcadeData
-
CVE-2026-114059
ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missin -
CVE-2026-114058
ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization vi -
CVE-2026-114056
ArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via -
CVE-2026-93598
ArcadeDB before 26.9.1 Classpath Credential Disclosure via R -
CVE-2026-93597
ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses
Same weakness: CWE-862
-
CVE-2026-111849
WordPress WpTravelly plugin <= 2.3.5 - Broken Access Control -
CVE-2026-114390
Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authoriz -
CVE-2026-114387
Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarde -
CVE-2026-114388
Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authoriz -
CVE-2026-114120
SchedulePress before 5.3.5 Missing Authorization via wpsp_el
V. Comments for CVE-2026-114057
No comments yet