Is CVE-2026-119577 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119577 being exploited in the wild.

How severe is CVE-2026-119577?

Medium severity, with a CVSS score of 6.8, published 30 October 2026.

Which products and versions are affected?

ArcadeData ArcadeDB before 26.10.2.

Is there a fix for CVE-2026-119577?

Yes: fixed in 26.10.2. Until then: On earlier versions, restart the server or the wire-protocol listeners after revoking a user to close all connections opened before the revocation. [ { "kind": "disclosed", "at": "2026-10-15", "note": "GitHub security advisory published" }, { "kind": "advisory", "at": "2026-10-30", "note": "NVD published" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-119577 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-119577?

Check whether you run ArcadeData ArcadeDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119577: ArcadeDB improper authorization in wire-protocol connections

CVE-2026-119577 · Severity: medium · CVSS 6.8 · Published 2026-10-30

ArcadeDB is a database server that supports multiple wire-protocol connections (Postgres, Bolt, MongoDB, Redis). A security flaw allows users whose access has been revoked—through account deletion, password rotation, or removal of database permissions—to continue reading and writing data through connections that were already open before the revocation. This means an administrator cannot immediately cut off access to compromised or departed users if they maintain an existing connection.

Technologies: ArcadeData ArcadeDB. Vendors: ArcadeData.

Quick answers

Is CVE-2026-119577 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119577 being exploited in the wild.
How severe is CVE-2026-119577?: Medium severity, with a CVSS score of 6.8, published 30 October 2026.
Which products and versions are affected?: ArcadeData ArcadeDB before 26.10.2.
Is there a fix for CVE-2026-119577?: Yes: fixed in 26.10.2. Until then: On earlier versions, restart the server or the wire-protocol listeners after revoking a user to close all connections opened before the revocation.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-10-15", "note": "GitHub security advisory published" }, { "kind": "advisory", "at": "2026-10-30", "note": "NVD published" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119577 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-119577?: Check whether you run ArcadeData ArcadeDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 26.10.2

On earlier versions, restart the server or the wire-protocol listeners after revoking a user to close all connections opened before the revocation.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-10-15", "note": "GitHub security advisory published" }, { "kind": "advisory", "at": "2026-10-30", "note": "NVD published" } ]

Technical details

The vulnerability is an improper session expiration flaw (CWE-613, CWE-863) in wire-protocol executors (Postgres, Bolt, MongoDB, Redis). Each executor holds a stale ServerSecurityUser object obtained at authentication; when ServerSecurity.updateUser replaces map entries or deletes users, the cached principal is not invalidated, so group changes or user deletion do not apply to already-open connections. The fix (26.10.2) adds revalidation of the principal from the server security map before each request, enforcing revocation checks equivalent to those already applied on the HTTP API.

Affected products

ArcadeData ArcadeDB before 26.10.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.