CVE-2026-119577
Deferred Deferred - Pending Action

Improper Authorization in ArcadeDB via Stale Connections

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDB, or Redis wire-protocol connections. Attackers holding an existing connection can keep reading and writing data after deletion, grant removal, or password rotation, because executors keep a stale ServerSecurityUser.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119577
EUVD
EUVD-2026-113931

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ArcadeData arcadedb 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-613 According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ArcadeDB before version 26.10.2 has an improper authorization flaw where revoked users can still access the system through open Postgres, Bolt, MongoDB, or Redis connections. Even after a user is deleted, has their access revoked, or their password changed, existing connections remain active because the system retains a stale ServerSecurityUser object.

Detection Guidance

Check for active Postgres, Bolt, MongoDB, or Redis connections from revoked users by monitoring connection logs and user access lists. Look for stale ServerSecurityUser entries in ArcadeDB logs or configuration files.

Impact Analysis

Attackers with an existing connection could continue reading or writing data even after their access was revoked. This could lead to unauthorized data access, modification, or exfiltration. The impact includes potential data breaches, integrity issues, and loss of sensitive information.

Compliance Impact

This vulnerability could violate compliance requirements that mandate timely revocation of access and protection of sensitive data. Organizations might fail GDPR's data protection principles or HIPAA's access control rules, leading to legal penalties, fines, or reputational damage.

Mitigation Strategies

Upgrade ArcadeDB to version 26.10.2 or later. Terminate all existing connections from revoked users and enforce re-authentication for active sessions. Review and rotate credentials for affected users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119577. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart