CVE-2026-42072

The record

Nornicdb is a distributed low-latency, Graph+Vector, Temporal MVCC with all sub-ms HNSW search, graph traversal, and writes. Prior to version 1.0.42-hotfix, the --address CLI flag (and NORNICDB_ADDRESS / server.host config key) is plumbed through to the HTTP server correctly but never reaches the Bolt server config. The Bolt listener therefore always binds to the wildcard address (all interfaces), regardless of what the user configures. On a LAN, this exposes the graph database — with its default admin:password credentials — to any device sharing the network. This issue has been patched in version 1.0.42-hotfix.

Affected packages

Related vulnerabilities

• GHSA-2hp7-65r3-wv54 NornicDB has Improper Network Binding in its Bolt Server, allowing unauthorized remote… Same vulnerability
• CVE-2026-86464 In the current development version of Eclipse aeriOS, for which no official release has… CWE-1392
• CVE-2026-65313 A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering… CWE-1392
• CVE-2026-68503 LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. CWE-1392
• CVE-2026-46386 OpenProject is open-source, web-based project management software. CWE-1392
• CVE-2026-44273 Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain a Use of Default… CWE-1392
• CVE-2026-32652 Dell AIOps Collector versions prior to 1.18.3 contain a "Use of Default Credentials"… CWE-1392
• CVE-2026-50005 Brickcom cameras ship with default credentials that allows any unauthenticated remote… CWE-1392