GHSA-2hp7-65r3-wv54
Critical · 9.8NornicDB has Improper Network Binding in its Bolt Server, allowing unauthorized remote access
CVSS
9.8
EPSS
—
Published
Apr 22, 2026
CISA due date
—
The record
The `--address` CLI flag (and `NORNICDB_ADDRESS` / `server.host` config key) is plumbed through to the HTTP server correctly but **never reaches the Bolt server config**. The Bolt listener therefore always binds to the wildcard address (all interfaces), regardless of what the user configures. On a LAN, this exposes the graph database — with its default `admin:password` credentials — to any device sharing the network.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-42072 Nornicdb is a distributed low-latency, Graph+Vector, Temporal MVCC with all sub-ms HNSW… Same vulnerability
- CVE-2026-86464 In the current development version of Eclipse aeriOS, for which no official release has… CWE-1392
- CVE-2026-65313 A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering… CWE-1392
- CVE-2026-68503 LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. CWE-1392
- CVE-2026-46386 OpenProject is open-source, web-based project management software. CWE-1392
- CVE-2026-44273 Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain a Use of Default… CWE-1392
- CVE-2026-32652 Dell AIOps Collector versions prior to 1.18.3 contain a "Use of Default Credentials"… CWE-1392
- CVE-2026-50005 Brickcom cameras ship with default credentials that allows any unauthenticated remote… CWE-1392