CVE-2026-114058
Medium · 4.3CVSS
4.3
EPSS
0.3%
Published
Oct 21, 2026
CISA due date
—
The record
ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metadata. Attackers with credentials for one database can set the db field in RUN or BEGIN messages and call db.labels() or SHOW INDEXES to enumerate unauthorized schemas.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-55147 LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application… CWE-862
- CVE-2026-55146 LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application… CWE-862
- CVE-2026-62967 ZTNET is a ZeroTier web UI for private controllers with multiuser and organization… CWE-862
- CVE-2026-62989 Shopper is a Headless e-commerce Admin Panel. CWE-862
- CVE-2026-78403 Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel… CWE-862
- CVE-2026-62301 MyTube is a self-hosted downloader and player for several video websites. CWE-862
- CVE-2026-119337 RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. CWE-862
- CVE-2026-116245 libpq looks a connection service up in the service file of the operating-system account… CWE-862