CVE-2026-81190: KurrentDB: Privileged access to read $all enables arbitrary file read and GET-only SSRF
KurrentDB is a database engineered for modern software applications and event-driven architectures. In version 26.1.0, a user authorized to read the $all stream can use Secondary Indexing query capabilities to read arbitrary files accessible to the database process, enumerate directories, and issue HTTP GET requests from that process. The default configuration limits this privilege to administrators. The flaw does not permit file writes and does not expose environment variables. This issue is fixed in version 26.1.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
KurrentDBto a version that resolves this vulnerability.Fixed in 26.1.1
Event History
Frequently Asked Questions
Who is exposed under the default configuration?
By default, the ability to read the $all stream is limited to administrators. Systems are exposed when an administrator or another user granted $all read authorization can use Secondary Indexing queries.
What access does an attacker need to exploit this issue?
The attacker needs authorization to read the $all stream. No user interaction is required, and the issue can be exploited over the network.
What could an attacker do with successful exploitation?
They can read files accessible to the KurrentDB process, enumerate directories, and make HTTP GET requests from that process. The issue does not allow file writes or exposure of environment variables.
How can this be remediated?
Upgrade KurrentDB from version 26.1.0 to version 26.1.1, which fixes the issue. If upgrading is not immediately possible, restrict $all stream read authorization to only highly trusted administrators.