CVE-2026-119577

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.10.2

Description An improper authorization issue exists where users who have had their access revoked can maintain connectivity through active Postgres, Bolt, MongoDB, or Redis wire-protocol connections. This occurs because executors retain a stale ServerSecurityUser object, allowing attackers with an established connection to continue reading and writing data even after their account has been deleted, their grants removed, or their password rotated.

Recommendations Update to version 26.10.2.