Vulnerability record/PUBLISHED/Published Oct 30, 2026 13:18:15 UTC

CVE-2026-119577

ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDB, or Redis wire-protocol connections. Attackers holding an existing connection can keep reading and writing data after deletion, grant removal, or password rotation, because executors keep a stale ServerSecurityUser.

Base score7.6/ 10

SeverityHighCVSS 4.0

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityHigh

Attack vectorNetworkAV

Attack complexityLowAC

Attack requirementsPresentAT

Privileges requiredLowPR

User interactionNoneUI

Vulnerable system confidentialityHighVC

Vulnerable system integrityHighVI

Vulnerable system availabilityNoneVA

Subsequent system confidentialityNoneSC

Subsequent system integrityNoneSI

Subsequent system availabilityNoneSA

CVSS vector stringCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityVulnCheck

Last updatedOct 30, 2026 15:53:42 UTC

PublishedOct 30, 2026 13:18:15 UTC

ReservedOct 30, 2026 10:56:15 UTC