CVE-2026-114057 — ArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Information Disclosure
ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that allows authenticated users to enumerate all database names. …
Published: 2026-10-21 · CVSS: 5.3 · CVSS 4.0
ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that allows authenticated users to enumerate all database names. Attackers with credentials for any single database can issue a SHOW DATABASES query over the Bolt port to reveal unauthorized database names, exposing tenant or project identifiers.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7