ArcadeDB Missing Authorization in Bolt Protocol Handler

Executive Summary

This vulnerability in ArcadeDB (CVE-2026-114058) is a missing authorization flaw in the Bolt protocol handler. It allows authenticated users with access to one database to read schema metadata from other databases on the same server without proper authorization. The issue occurs because the Bolt protocol handler does not enforce per-database authorization checks when switching databases.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic on the default Bolt port (7687) for suspicious RUN or BEGIN messages with modified db fields. Check ArcadeDB logs for unauthorized schema metadata access attempts like db.labels() or SHOW INDEXES calls. Use packet inspection tools like Wireshark to filter for Bolt protocol traffic and verify if users are querying schemas outside their authorized databases.

Useful 0 Not Useful 0

Impact Analysis

An attacker with valid credentials for one database could exploit this to enumerate schema metadata from other databases, including node/relationship types, property keys, and index definitions. While actual record data remains protected, the exposed schema details could help attackers plan further exploits or reconnaissance.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability exposes database schema metadata, which could indirectly impact compliance by revealing system structure details that might aid in further attacks. However, the actual record data remains protected, limiting direct regulatory violations. GDPR and HIPAA focus on unauthorized data access; since no records are exposed, the primary risk is secondary exploitation rather than direct non-compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Restrict network access to the Bolt port (7687) by binding it to trusted IPs or using firewalls. Temporarily disable the Bolt protocol if not required. Monitor for unauthorized schema queries and update ArcadeDB to a patched version once available. Review user permissions to ensure least privilege access across databases.

Useful 0 Not Useful 0