CVE-2026-119577 ArcadeDB before 26.10.2 Improper Session Revocation in Wire-Protocol Connections
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119577?
CVE-2026-119577 is a high-severity vulnerability in ArcadeData arcadedb, published on 30 Oct 2026.
Official description
ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDB, or Redis wire-protocol connections. Attackers holding an existing connection can keep reading and writing data after deletion, grant removal, or password rotation, because executors keep a stale ServerSecurityUser.
Weakness: CWE-613
Which versions are affected by CVE-2026-119577?
How do I fix CVE-2026-119577?
No fix has been published for CVE-2026-119577 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119577 being exploited?
There is no known exploitation of CVE-2026-119577 in the wild and no public exploit code.
Sources
Also known as GHSA-v25h-f6ww-7597, GHSA-vc4x-rm58-r9cr.