CVE-2026-114058— ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization via Bolt Protocol
Quick assessment
Affected
ArcadeData arcadedb
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ArcadeDB 26.2.1 至 26.10.1（不含）版本中的 Bolt 协议处理器存在缺失授权验证的漏洞，使得已认证用户能够读取其他数据库的模式元数据。拥有任一数据库凭据的攻击者可在 RUN 或 BEGIN 消息中设置 字段，并调用 或 来枚举未经授权的 schema（模式）。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114058
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization via Bolt Protocol
Source: CVE Program / CVE List V5
Vulnerability Description
ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metadata. Attackers with credentials for one database can set the db field in RUN or BEGIN messages and call db.labels() or SHOW INDEXES to enumerate unauthorized schemas.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ArcadeData | arcadedb | 26.2.1 ~ 26.10.1 | - |
|
II. Public POCs for CVE-2026-114058
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114058
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-114058 (2)
Same Patch Batch · ArcadeData · 2026-10-21 · 4 CVEs total
| CVE-2026-114059 | 7.5 HIGH | ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing Authorization |
| CVE-2026-114056 | 4.3 MEDIUM | ArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via ALTER TYPE WITH |
| CVE-2026-114057 | 4.3 MEDIUM | ArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Information Disclosure |
IV. Related Vulnerabilities
Same product: arcadedb
-
CVE-2026-114059
ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missin -
CVE-2026-114057
ArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Informati -
CVE-2026-114056
ArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via -
CVE-2026-93598
ArcadeDB before 26.9.1 Classpath Credential Disclosure via R -
CVE-2026-93597
ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses
Same vendor: ArcadeData
-
CVE-2026-114059
ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missin -
CVE-2026-114057
ArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Informati -
CVE-2026-114056
ArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via -
CVE-2026-93598
ArcadeDB before 26.9.1 Classpath Credential Disclosure via R -
CVE-2026-93597
ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses
Same weakness: CWE-862
-
CVE-2026-111849
WordPress WpTravelly plugin <= 2.3.5 - Broken Access Control -
CVE-2026-114390
Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authoriz -
CVE-2026-114387
Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarde -
CVE-2026-114388
Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authoriz -
CVE-2026-114120
SchedulePress before 5.3.5 Missing Authorization via wpsp_el
V. Comments for CVE-2026-114058
No comments yet