CVE-2026-114057 ArcadeData CVE debrief

Who should care

Database administrators, security teams, and developers using ArcadeDB are primarily affected by this vulnerability. They should be aware of the potential for unauthorized database enumeration and take steps to mitigate the risk. This includes updating to version 26.10.1 or later, restricting access to the Bolt port, and monitoring database queries for suspicious activity. Additionally, stakeholders responsible for vulnerability management, platform safety

Why it matters

CVE-2026-114057 is a medium-severity vulnerability in ArcadeDB's Bolt protocol handler, allowing authenticated users to disclose database names. Defenders should prioritize updating to version 26.10.1 or later, restrict access to the Bolt port, and monitor database queries.

• Potential unauthorized database enumeration
• Increased risk of targeted attacks
• Need for version updates and access controls

Technical summary

The ArcadeDB Bolt protocol handler has a missing authorization vulnerability, allowing authenticated users to enumerate all database names. This issue arises from inadequate access controls in the Bolt protocol, enabling attackers to issue a SHOW DATABASES query and reveal unauthorized database names. The vulnerability affects ArcadeDB versions from 26.2.1 before 26.10.1 and has a CVSS score of 5.3, classified as medium severity. Defenders should focus on updating to the patched version and implementing access controls.

Defensive priority

Medium priority for authentication and database management systems

Recommended defensive actions

• Review and update ArcadeDB versions to 26.10.1 or later
• Restrict access to the Bolt port
• Monitor database queries for unauthorized access
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the missing authorization vulnerability in ArcadeDB's Bolt protocol handler. The vulnerability allows authenticated users to enumerate all database names, potentially exposing sensitive information such as tenant or project identifiers. Evidence from the CVE Program and NVD supports this assessment, but further verification is recommended to ensure accurate scope and impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.