# CVE-2026-114057: ArcadeDB missing authorization in Bolt protocol handler

Source: https://junglewise.ai/threats/cve-2026-114057-arcadedb-from-26-2-1-before-26-10-1-contains-a-missing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-114057 · Severity: medium · CVSS 4.3 · Published 2026-10-21

ArcadeDB is a multi-tenant database platform that manages separate databases with per-user access controls. The Bolt wire protocol handler fails to filter database listings, allowing any authenticated user to see all database names on the server, even databases they lack permission to access. This database name enumeration can leak business-sensitive identifiers like tenant, client, or project names that attackers could use for reconnaissance.

Technologies: [ArcadeData ArcadeDB](https://junglewise.ai/threats/technologies/arcadedb). Vendors: [ArcadeData](https://junglewise.ai/threats/vendors/arcadedata).

## Quick answers

**Is CVE-2026-114057 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114057 being exploited in the wild.

**How severe is CVE-2026-114057?** Medium severity, with a CVSS score of 4.3, published 21 October 2026.

**Which products and versions are affected?** ArcadeData ArcadeDB 26.2.1 before 26.10.1.

**Is there a fix for CVE-2026-114057?** Yes: fixed in 26.10.1. Until then: Restrict network access to the Bolt port (7687) to trusted clients only by configuring firewall rules or binding BOLT_HOST to a non-default interface. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114057 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-114057?** Check whether you run ArcadeData ArcadeDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 26.10.1

Restrict network access to the Bolt port (7687) to trusted clients only by configuring firewall rules or binding BOLT_HOST to a non-default interface.

## Technical details

The Bolt protocol handler's SHOW DATABASES command returns the unfiltered server database list without per-user authorization checks, whereas the HTTP and gRPC handlers correctly apply filterAuthorizedDatabases(). An authenticated attacker with valid credentials for any single database can connect to the Bolt endpoint and enumerate all database names. The vulnerability requires valid credentials (PR:L) and network access to the Bolt port (default 7687), with confidentiality impact limited to metadata exposure only.

## Affected products

- ArcadeData ArcadeDB 26.2.1 before 26.10.1

## Timeline

- 2026-10-05: disclosed
- 2026-10-21: advisory

## References

- [https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-7fcg-pg8x-wf7w](https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-7fcg-pg8x-wf7w)
- [https://www.vulncheck.com/advisories/arcadedb-26.2.1-before-26.10.1-bolt-show-databases-information-disclosure](https://www.vulncheck.com/advisories/arcadedb-26.2.1-before-26.10.1-bolt-show-databases-information-disclosure)

## Related threats

- [ArcadeDB improper authorization in wire-protocol connections](https://junglewise.ai/threats/cve-2026-119577-arcadedb-before-26-10-2-contains-an-improper-authorization)
- [ArcadeDB authorization bypass in GraphQL schema endpoint](https://junglewise.ai/threats/cve-2026-119576-arcadedb-from-21-12-1-before-26-10-2-contains-an-authorization)
- [ArcadeDB server-side request forgery in LOAD CSV](https://junglewise.ai/threats/cve-2026-119575-arcadedb-from-26-8-1-before-26-10-2-contains-a-server-side)
- [ArcadeDB remote code execution in Gremlin Groovy engine](https://junglewise.ai/threats/cve-2026-114059-arcadedb-before-26-10-1-contains-a-remote-code-execution)
- [ArcadeDB Bolt protocol missing authorization](https://junglewise.ai/threats/cve-2026-114058-arcadedb-from-26-2-1-before-26-10-1-contains-a-missing)