NVD security advisoryHigh
High advisory for ArcadeDB
CVE-2026-119577 · Reported 30 Oct 2026
Full advisory details, affected packages, severity context, and original source.
Affected technology
ArcadeDBAffected product
Advisory overview
ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDB, or Redis wire-protocol connections. Attackers holding an existing connection can keep reading and writing data after deletion, grant removal, or password rotation, because executors keep a stale ServerSecurityUser.