CVE-2026-114057 ArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Information Disclosure

Medium 5.3 Published 21 Oct 2026 Updated 22 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-114057?

CVE-2026-114057 is a medium-severity vulnerability in ArcadeData arcadedb, published on 21 Oct 2026.

Official description

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that allows authenticated users to enumerate all database names. Attackers with credentials for any single database can issue a SHOW DATABASES query over the Bolt port to reveal unauthorized database names, exposing tenant or project identifiers.

Weakness: CWE-862

Which versions are affected by CVE-2026-114057?

How do I fix CVE-2026-114057?

No fix has been published for CVE-2026-114057 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-114057 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-114057 exists.

Sources

Also known as GHSA-7fcg-pg8x-wf7w, GHSA-vp2h-6426-v5wh.