Missing Authorization in ArcadeDB via Bolt Protocol

Executive Summary

This vulnerability in ArcadeDB (CVE-2026-114057) is a missing authorization flaw in the Bolt protocol handler. It allows authenticated users to list all database names on a server, even those they don't have access to, by executing a SHOW DATABASES query. The issue occurs because the Bolt protocol does not enforce user-specific authorization checks like other protocols (HTTP, gRPC) do.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the SHOW DATABASES query over the Bolt port (default 7687) returns database names beyond those the authenticated user should access. Use a Bolt client like 'bolt' command-line tool or Neo4j Browser to connect to port 7687 and execute SHOW DATABASES. If unauthorized databases appear, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

An attacker with valid credentials for any single database could exploit this to enumerate all database names, potentially exposing sensitive metadata such as tenant or project identifiers. This could lead to further targeted attacks or unauthorized information gathering.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and data isolation, such as GDPR's data protection principles or HIPAA's safeguards for protected health information. Unauthorized database enumeration may expose sensitive data, leading to regulatory penalties or breaches of confidentiality.

Useful 0 Not Useful 0

Mitigation Strategies

Restrict access to the Bolt port (7687) by firewall rules to trusted IPs only. Disable the Bolt protocol if not required. Monitor network traffic for SHOW DATABASES queries on port 7687. Consider upgrading to a patched version if available, though no official patch exists as of the advisory date.

Useful 0 Not Useful 0