Vulnerability Description
ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metadata. Attackers with credentials for one database can set the db field in RUN or BEGIN messages and call db.labels() or SHOW INDEXES to enumerate unauthorized schemas.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-hw9x-xx38-rg28
- https://www.vulncheck.com/advisories/arcadedb-from-26.2.1-before-26.10.1-missing
- https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-hw9x-xx38-rg28
FAQ
What is CVE-2026-114058?
CVE-2026-114058 is a vulnerability with a CVSS score of 4.3 (MEDIUM). ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metadata. Attackers with cred...
How severe is CVE-2026-114058?
CVE-2026-114058 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-114058?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.