---
id: CVE-2026-119577
title: >-
  ArcadeDB before 26.10.2 Improper Session Revocation in Wire-Protocol
  Connections
summary: >-
  ArcadeDB before 26.10.2 contains an improper authorization vulnerability that
  allows revoked users to retain access through already-open Postgres, Bolt,
  MongoDB, or Redis wire-protocol connections. Attackers holding an existing
  connectio…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-613
vendor: ArcadeData
product: arcadedb
affected:
  - arcadedb < 26.10.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-30T15:34:54.354034Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T15:53:42.078Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119577'
references:
  - url: >-
      https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-vc4x-rm58-r9cr
    label: GitHub Security Advisory (GHSA-vc4x-rm58-r9cr)
  - url: >-
      https://www.vulncheck.com/advisories/arcadedb-before-26.10.2-improper-session-revocation-in-wire-protocol-connections
    label: >-
      VulnCheck Advisory: ArcadeDB before 26.10.2 Improper Session Revocation in
      Wire-Protocol Connections
tags:
  - cve.org
epss: 0.00285
epssPercentile: 0.21122
ingestedAt: '2026-11-05T16:07:30.520Z'
---

## Overview

ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDB, or Redis wire-protocol connections. Attackers holding an existing connection can keep reading and writing data after deletion, grant removal, or password rotation, because executors keep a stale ServerSecurityUser.

## Affected

- `arcadedb < 26.10.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.