Vulnerability in graph (CVE-2026-42072, CVSS 9.8)

Summary

vulnerability in graph (CVE-2026-42072). Successful exploitation can lead to full system takeover. Exploitable via NORNICDB_ADDRESS.

Original description

The description as published by the source.

Summary

The --address CLI flag (and NORNICDB_ADDRESS / server.host config key) is plumbed through to the HTTP server correctly but never reaches the Bolt server config. The Bolt listener therefore always binds to the wildcard address (all interfaces), regardless of what the user configures.

On a LAN, this exposes the graph database — with its default admin:password credentials — to any device sharing the network.

Version

nornicdb v1.0.39
Built from commit afe7c9d on main
Platform: macOS (darwin 25.4.0, arm64)

Reproduction

$ nornicdb serve --address 127.0.0.1 --bolt-port 7687 --http-port 7474 ...

Output claims Bolt is on localhost:

Bolt server listening on bolt://localhost:7687

But the actual socket:

$ netstat -an -p tcp | grep 7687
tcp46      0      0  *.7687                 *.*                    LISTEN

$ lsof -iTCP:7687 -sTCP:LISTEN -n -P
nornicdb ... IPv6 ... TCP *:7687 (LISTEN)

HTTP port is correctly bound:

tcp4  127.0.0.1.7474   *.*  LISTEN

Reachable from another host on the LAN:

$ nc -z 192.168.x.y 7687
Connection to 192.168.x.y port 7687 [tcp/*] succeeded!

Setting NORNICDB_BOLT_ADDRESS=127.0.0.1 or server.host: "127.0.0.1" in config.yaml has no effect on the Bolt listener.

Root Cause

In pkg/bolt/server.go:774-776:

func (s *Server) ListenAndServe() error {
    addr := fmt.Sprintf(":%d", s.config.Port)
    listener, err := net.Listen("tcp", addr)
    ...
}

`b…

Source: NIST National Vulnerability Database NVD GitHub Advisory

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

A critical vulnerability in NornicDB database software has been identified, allowing attackers to access the database with default admin passwords via the network. Versions affected are below 1.0.42, with a fix in version 1.0.42-hotfix. Update the software immediately and configure firewall settings to prevent unauthorized access as a temporary measure.

This vulnerability in NornicDB stems from the --address CLI flag not propagating to the Bolt server config, resulting in it binding to a wildcard address. This affects versions below v1.0.42, fixed in v1.0.42-hotfix. A temporary workaround is to block non-localhost access to the Bolt port (typically 7687) with host firewall rules.

❓ What is the problem

Boltサーバがデフォルトでワイルドカードアドレスにバインドする

📍 Affected scope

NornicDBのBoltサーバ設定

🔥 Severity

Critically allows unauthorized network access

🔧 How to fix

パッチを適用し、CLIフラグを適切にBoltサーバに通す修正を行う (v1.0.42-hotfix)

🛡️ Workaround

ホストファイアウォールでBoltポート(7687)に対する非ローカルアクセスをブロック

🔍 Detection

ネットワーク上でデフォルトの資格情報 admin:password での不正な接続を監視

Related past incidents Similar incidents extracted from past CVEs

CVE-2022-0185

unauthorized access due to a network misconfiguration.

CVE-2021-3156

Improper handling of wildcard characters leading to privilege escalation.

CVE-2026-40001

Another case of improper server configuration leading to data exposure.

If this happens at your company Expected impact per business scenario

📌 In an e-commerce setting

Attacker could access customer data and orders, leading to a data breach.

📌 Within a company’s internal systems

Sensitive financial data could be exposed to unauthorized internal users.

📌 In a SaaS multi-tenant architecture

One tenant's data may be improperly accessed by another tenant.

Recommended action

Update software to v1.0.42-hotfix immediately; use firewall rules to block unauthorized access until patching.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
Audit SBOM/dependencies for affected components.
```
依存マニフェストで影響コンポーネントを特定する。
2
Match against affected range verify
```
Confirm if version satisfies `<1.0.42`
```
Step 1 で見つかったバージョンが影響範囲 <1.0.42 に該当するか照合。本番で稼働中ならインシデント扱い。
7
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。

Affected packages

go github.com/orneryd/nornicdb

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.42-hotfix"}]}]

References

advisory nvd.nist.gov
package github.com
web github.com
web github.com
web github.com
web github.com
web github.com