EUVD-2026-107009
GHSA-mm98-wwp8-h6xc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to one database via Bolt
-
ExploitSet db field to target database in RUN/BEGIN
-
ExecutionCall db.labels() or SHOW INDEXES
-
ImpactEnumerate unauthorized schema metadata
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires valid authenticated credentials for at least one database on the target ArcadeDB server (PR:L) and network reachability to the Bolt protocol handler, which must be enabled/exposed. The attacker exploits it by setting the db field in a RUN or BEGIN message to a database for which they lack authorization, then invoking db.labels() or SHOW INDEXES. Exploitation is limited to read-only disclosure of schema metadata (labels and indexes) of other databases - no data content, no write access, and no availability impact. Affected versions are 26.2.1 up to (but not including) 26.10.1; upgrading to 26.10.1 remediates. Risk is meaningfully realized only in multi-database/multi-tenant deployments where database-level isolation is relied upon. |
| Impact | Signals are consistent and point to a genuine-but-moderate issue rather than a top priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring low privileges, with only low confidentiality impact (VC:L) and no integrity or availability impact (VI:N/VA:N), yielding 5.3 (Medium) - the description corroborates this, as exploitation yields only schema metadata disclosure across database boundaries, not data read/write or code execution. No EPSS score was provided, the CVE is not listed in CISA KEV, and no proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The PR:L requirement is the key limiter: an attacker must already hold valid credentials for at least one database on the server, making this a horizontal authorization/privilege-boundary bypass (CWE-862) useful mostly in multi-tenant or shared-instance deployments rather than a pre-auth internet-wide threat. No conflicting signals were observed; the main missing data is EPSS and any independent confirmation of exploitation. |
| Exploit ScenarioDerived | An attacker holding legitimate credentials for one tenant database on a shared ArcadeDB server connects over the Bolt protocol and sets the db field in a RUN or BEGIN message to a database they are not authorized for. They then issue db.labels() or SHOW INDEXES to enumerate the other tenant's schema (labels, indexes), gaining reconnaissance about data structures they should not see. No public exploit is identified, but the low attack complexity (AC:L) and simple message manipulation make it straightforward for any authenticated user. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
ArcadeDB versions 26.2.1 through 26.10.0 expose a missing authorization check in the Bolt protocol handler that lets any user holding credentials for one database read schema metadata - labels and index definitions - belonging to other databases on the same server. Because the handler trusts the attacker-supplied db field in RUN or BEGIN messages rather than validating the caller's authorization for that database, a low-privileged authenticated user can pivot across tenants with a single message field and calls to db.labels() or SHOW INDEXES. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; impact is confined to read-only information disclosure (no data content, no writes, no availability effect), so real risk concentrates in multi-database or multi-tenant deployments that depend on database-level isolation.
RemediationAI
Vendor-released patch: upgrade ArcadeDB to 26.10.1 or later, the first release containing the authorization fix described in GHSA-hw9x-xx38-rg28 (https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-hw9x-xx38-rg28); the VulnCheck advisory at https://www.vulncheck.com/advisories/arcadedb-from-26.2.1-before-26.10.1-missing-authorization-via-bolt-protocol provides additional detail. Until the upgrade can be scheduled, the most effective compensating control is to stop exposing Bolt to untrusted networks - bind the Bolt listener to localhost or a management VLAN, or firewall the Bolt port so only trusted driver hosts can reach it - accepting the trade-off that remote applications and BI/graph tooling must be re-homed or tunneled. Where multiple tenants share an instance, avoid issuing Bolt credentials that belong to more than one logical database and consider splitting tenants onto separate ArcadeDB servers or separate instances, at the cost of additional infrastructure and operational overhead. Note that disabling the Bolt protocol entirely (if HTTP/other APIs suffice) removes the attack path but breaks Neo4j-driver compatibility and any Cypher-over-Bolt clients. Because the weakness only yields schema metadata rather than data content, no log-scrubbing or credential-rotation response is strictly required, though reviewing audit logs for unexpected db fields in RUN/BEGIN messages from users of a single database can help confirm whether the flaw was probed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ArcadeDB is a multi-model (graph, document, key-value, time-series) DBMS written in Java, and its Bolt protocol handler implements the Neo4j-compatible binary protocol so that drivers such as neo4j-java-driver can connect. In Bolt, a session is bound to a database via the db field carried in RUN (and BEGIN) messages; the handler is expected to verify that the authenticated principal is permitted to act on the requested database. The flaw is CWE-862 (Missing Authorization): that authorization check is absent, so the server honors whatever db value the client supplies. An attacker who authenticates against any database they legitimately hold credentials for can then address a different database by name and invoke introspection procedures and administrative-style read commands - db.labels() to enumerate node/edge type names and SHOW INDEXES to enumerate index names, properties, and uniqueness constraints - thereby mapping another tenant's schema. The weakness is metadata-only: it discloses structural information that assists reconnaissance and can reveal application domain models, table/type naming, and index design, but it does not return stored records, permit modification, or degrade service. The CVSS:4.0 vector supplied by the reporter (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) matches the independent CVSS:3.1 assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, both scoring the defect as low-confidentiality with no integrity or availability impact.
Know when Arcadedb gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network Bolt access with valid single-database credentials gives AV:N/AC:L/PR:L; only cross-database schema metadata leaks, so C:L and I:N/A:N, scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metadata. Attackers with credentials for one database can set the db field in RUN or BEGIN messages and call db.labels() or SHOW INDEXES to enumerate unauthorized schemas.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in ArcadeDB Authorization Bypass Vulnerabilities
View all 4Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exp
Privilege escalation in ArcadeDB server (versions 26.7.3 and earlier) allows a low-privileged authenticated user with re
Privilege escalation in ArcadeDB before 26.8.1 lets a low-privileged authenticated reader escalate to full server admini
Authentication bypass in ArcadeDB before 26.8.1 lets unauthenticated attackers run full CRUD operations against any data
Scripting authorization bypass in ArcadeDB before 26.7.2 lets any authenticated database user - including read-only role
Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the s
Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version
Cross-database authorization bypass in ArcadeDB's Gremlin wire-protocol plugin allows any authenticated server user to f
Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to
Cluster token exposure in ArcadeDB before 26.7.2 enables any authenticated user to escalate privileges to root-level adm
Privilege escalation in ArcadeDB before 26.7.3 allows any user holding UPDATE_SCHEMA permission to create server-wide ad
Remote OS command execution in ArcadeDB before 26.7.2 is reachable by authenticated schema administrators through JavaSc
Exploit-DB