What is GHSA-mm98-wwp8-h6xc?

GHSA-mm98-wwp8-h6xc is a security advisory published by GitHub Security Advisories with Medium severity. ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt...

Which CVE IDs does GHSA-mm98-wwp8-h6xc cover?

GHSA-mm98-wwp8-h6xc covers the following CVE IDs: CVE-2026-114058. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mm98-wwp8-h6xc?

GHSA-mm98-wwp8-h6xc has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-mm98-wwp8-h6xcMediumCVSS 4.3

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt...

Vendor

GitHub Security Advisories

Published

October 21, 2026

Last Modified

October 21, 2026

🔗 CVE IDs covered (1)

CVE-2026-114058 →

📋 Description

ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metadata. Attackers with credentials for one database can set the db field in RUN or BEGIN messages and call db.labels() or SHOW INDEXES to enumerate unauthorized schemas.

🔗 References (4)

https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-hw9x-xx38-rg28
https://nvd.nist.gov/vuln/detail/CVE-2026-114058
https://www.vulncheck.com/advisories/arcadedb-from-26.2.1-before-26.10.1-missing-authorization-via-bolt-protocol
https://github.com/advisories/GHSA-mm98-wwp8-h6xc