Executive brief
NornicDB is a high-performance graph database used for managing complex data relationships and AI-driven search. A security flaw in its network configuration causes the database's primary communication port (Bolt) to ignore security settings and remain open to the entire network. Because the database also uses a default administrator password, an attacker on the same network could gain full control over the data, allowing them to read, modify, or delete sensitive information.
Technical details
A logic error in NornicDB's configuration plumbing prevents the '--address' CLI flag and related configuration keys from reaching the Bolt server component. While the HTTP server correctly honors the bind address, the Bolt listener in 'pkg/bolt/server.go' defaults to a wildcard address (all interfaces) because the host field is missing from the Bolt configuration struct. An unauthenticated attacker on the same local area network (LAN) can connect to the Bolt port (default 7687) and use the default 'admin:password' credentials to execute arbitrary Cypher queries. This allows for full data exfiltration, modification, or deletion. The issue is resolved in version 1.0.42-hotfix by ensuring the bind address is correctly propagated to the Bolt server config.
Affected products
- orneryd NornicDB < 1.0.42-hotfix
Timeline
- 2026-04-17: patched: Fix committed to repository
- 2026-04-20: advisory: GitHub Security Advisory published
- 2026-05-08: disclosed: CVE published to NVD