CVE-2026-119577: ArcadeDB before 26.10.2 Improper Session Revocation in Wire-Protocol Connections

Published Oct 30, 2026

Updated

ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDB, or Redis wire-protocol connections. Attackers holding an existing connection can keep reading and writing data after deletion, grant removal, or password rotation, because executors keep a stale ServerSecurityUser.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ArcadeDB to a version that resolves this vulnerability.
Fixed in 26.10.2

Event History

Oct 30, 2026

CVE Published

via MITRE·01:18 PM

Data Sourced

via MITRE·01:18 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

ArcadeDB deployments before 26.10.2 are affected when clients use already-open Postgres, Bolt, MongoDB, or Redis wire-protocol connections. The issue applies to those existing connections rather than requiring a new connection after access is revoked.

What does an attacker need to exploit this?

The attacker needs to hold an existing wire-protocol connection established while their account or permissions were valid. They can retain access after user deletion, grant removal, or password rotation.

What access can persist after revocation?

An affected existing connection can continue reading and writing data because its executor retains a stale ServerSecurityUser. The vulnerability description does not indicate that availability is affected.

How can teams identify possible active exposure?

Review existing Postgres, Bolt, MongoDB, and Redis protocol connections associated with users whose accounts were deleted, grants removed, or passwords rotated. Such connections may still be able to perform reads and writes on affected versions.

CVE-2026-119577: ArcadeDB before 26.10.2 Improper Session Revocation in Wire-Protocol Connections

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this?

What access can persist after revocation?

How can teams identify possible active exposure?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this?

What access can persist after revocation?

How can teams identify possible active exposure?