Vulnerability · Published Oct 21, 2026 · Assigned by VulnCheck
CVE-2026-114058ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization via Bolt Protocol
Medium 4.3
In plain English
A medium-severity missing authorization in arcadedb from ArcadeData. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.3%top 77.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metadata. Attackers with credentials for one database can set the db field in RUN or BEGIN messages and call db.labels() or SHOW INDEXES to enumerate unauthorized schemas.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ArcadeData | arcadedb | 26.2.1 – before 26.10.1 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- GitHub Security Advisory (GHSA-hw9x-xx38-rg28) vendor-advisory
- VulnCheck Advisory: ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization via Bolt Protocol third-party-advisory