CVE-2026-114058: arcadedb 26.2.1 to before 26.10.1

Affected technology

arcadedb · 26.2.1 to before 26.10.1
ArcadeData

Description’s affected range: before 26.10.1

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Attackers with credentials for one database can set the db field in RUN or BEGIN messages and call db.labels() or SHOW INDEXES to enumerate unauthorized schemas. Vendor/CNA’s CVSS 4.0 assessment (base score 5.3/10) rates confidentiality impact as low; integrity and availability impact as none.