Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-119577— ArcadeDB before 26.10.2 Improper Session Revocation in Wire-Protocol Connections

Quick assessment

Affected

ArcadeData arcadedb

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ArcadeDB 在 26.10.2 版本之前存在授权不当漏洞，允许已被撤销权限的用户通过已建立的 Postgres、Bolt、MongoDB 或 Redis 线协议连接继续访问系统。攻击者若持有现有连接，可在用户被删除、权限被移除或密码被轮换后，继续读取和写入数据，原因是执行器保留了过时的 ServerSecurityUser 对象。

CVSS 6.8 · Medium Updated Oct 31, 2026

Possible ATT&CK Techniques 1 AI

T1078 · Valid Accounts

Affected Version Matrix 2

Vendor	Product	Version Range	Status
ArcadeData	arcadedb	`< 26.10.2`	affected
		`26.10.2`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

ArcadeDB before 26.10.2 Improper Session Revocation in Wire-Protocol Connections

Source: CVE Program / CVE List V5

Vulnerability Description

ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDB, or Redis wire-protocol connections. Attackers holding an existing connection can keep reading and writing data after deletion, grant removal, or password rotation, because executors keep a stale ServerSecurityUser.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

不充分的会话过期机制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
ArcadeData	arcadedb	0 ~ 26.10.2	-

II. Public POCs for CVE-2026-119577

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119577

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-119577 (1)

🔗 Open wire-protocol connections keep working after the user is deleted, loses its database grant, or has its password rotated and group narrowed (Postgres, Bolt, MongoDB, Redis) · Advisory · ArcadeData/arcadedb · GitHub Read full article vendor-advisory

Vendor Pages for CVE-2026-119577 (1)

🔗 ArcadeDB before 26.10.2 Improper Session Revocation in Wire-Protocol Connections | Advisories | VulnCheck third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119577

Same Patch Batch · ArcadeData · 2026-10-30 · 3 CVEs total

CVE-2026-119575	6.5 MEDIUM	ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List
CVE-2026-119576	4.3 MEDIUM	ArcadeDB from 21.12.1 before 26.10.2 GraphQL Schema Replacement via Read-Only Query Endpoi

IV. Related Vulnerabilities

Same product: arcadedb

Same vendor: ArcadeData

Same weakness: CWE-613