What is CVE-2026-119577?

CVE-2026-119577 is a medium-severity vulnerability in Arcadedata Arcadedb, classified under Insufficient Session Expiration. CVSS score: 6.8/10. Published 2026-10-30.

How severe is CVE-2026-119577?

Medium severity. CVSS v3 base score is 6.8 out of 10.

Vulnerability in Arcadedata Arcadedb

CVE-2026-119577

ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDB, or Redis wire-protocol connections. Attackers holding an existing connection can keep reading and writing data after deletion, grant removal, or password rotation, because executors keep a stale ServerSecurityUser.

Published 2026-10-30 · last modified 2026-10-30.

CVSS v3 metric

CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Arcadedata Arcadedb

Weakness classification (CWE)

CWE-613 — Insufficient Session Expiration

References

github.com/ArcadeData/arcadedb/security/advisories/GHSA-vc4x-rm58-r9cr (vendor-advisory)
www.vulncheck.com/advisories/arcadedb-before-26.10.2-improper-session-revocatio… (third-party-advisory)

Frequently asked questions

What is CVE-2026-119577?: CVE-2026-119577 is a medium-severity vulnerability in Arcadedata Arcadedb, classified under Insufficient Session Expiration. CVSS score: 6.8/10. Published 2026-10-30.
How severe is CVE-2026-119577?: Medium severity. CVSS v3 base score is 6.8 out of 10.