CVE-2026-119577Medium· 6.8▾ SunlitArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDB, or Redis wire-protocol connections. Attackers holding an existing connectio…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 37.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDB, or Redis wire-protocol connections. Attackers holding an existing connection can keep reading and writing data after deletion, grant removal, or password rotation, because executors keep a stale ServerSecurityUser.
arcadedb < 26.10.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-119575Medium· 6.5ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List
CVE-2026-119576Medium· 4.3ArcadeDB from 21.12.1 before 26.10.2 GraphQL Schema Replacement via Read-Only Query Endpoint
CVE-2026-114056Medium· 4.3ArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via ALTER TYPE WITH
CVE-2026-114057Medium· 4.3ArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Information Disclosure
CVE-2026-114058Medium· 4.3ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization via Bolt Protocol
CVE-2026-114059High· 7.5ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing Authorization