What’s Vulnerable › Vulnerabilities

CVE-2026-119577: ArcadeDB before 26.10.2 Improper Session Revocation in Wire-Protocol Connections

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-30 · updated 2026-10-30
• Weakness: CWE-613

Description

ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDB, or Redis wire-protocol connections. Attackers holding an existing connection can keep reading and writing data after deletion, grant removal, or password rotation, because executors keep a stale ServerSecurityUser.

Affected products

• ArcadeData arcadedb: before 26.10.2 — fixed in 26.10.2

How to fix

Upgrade to a fixed version: ArcadeData arcadedb 26.10.2. Check the vendor advisory for mitigations.

References

• https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-vc4x-rm58-r9cr
• https://www.vulncheck.com/advisories/arcadedb-before-26.10.2-improper-session-revocation-in-wire-protocol-connections

Get alerted when CVE-2026-119577 or the next vulnerability affects your stack