CVE-2026-81190

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-81190", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-26T16:26:08.968Z", "datePublished": "2026-11-05T20:52:19.064Z", "dateUpdated": "2026-11-09T18:38:50.304Z"}, "containers": {"cna": {"title": "KurrentDB: Privileged access to read $all enables arbitrary file read and GET-only SSRF", "problemTypes": [{"descriptions": [{"cweId": "CWE-73", "lang": "en", "description": "CWE-73: External Control of File Name or Path", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/kurrent-io/KurrentDB/security/advisories/GHSA-r8vq-5875-cq97", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/kurrent-io/KurrentDB/security/advisories/GHSA-r8vq-5875-cq97"}, {"name": "https://github.com/kurrent-io/KurrentDB/pull/5674", "tags": ["x_refsource_MISC"], "url": "https://github.com/kurrent-io/KurrentDB/pull/5674"}, {"name": "https://github.com/kurrent-io/KurrentDB/commit/18706d0d5fcec5e2fbb0d20f76638d113b5842c8", "tags": ["x_refsource_MISC"], "url": "https://github.com/kurrent-io/KurrentDB/commit/18706d0d5fcec5e2fbb0d20f76638d113b5842c8"}, {"name": "https://github.com/kurrent-io/KurrentDB/releases/tag/v26.1.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/kurrent-io/KurrentDB/releases/tag/v26.1.1"}, {"name": "https://kurrentdb.kurrent.io/releases/kurrentdb-26-1-1-security-release", "tags": ["x_refsource_MISC"], "url": "https://kurrentdb.kurrent.io/releases/kurrentdb-26-1-1-security-release"}], "affected": [{"vendor": "kurrent-io", "product": "KurrentDB", "versions": [{"version": "= 26.1.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T20:52:19.064Z"}, "descriptions": [{"lang": "en", "value": "KurrentDB is a database engineered for modern software applications and event-driven architectures. In version 26.1.0, a user authorized to read the $all stream can use Secondary Indexing query capabilities to read arbitrary files accessible to the database process, enumerate directories, and issue HTTP GET requests from that process. The default configuration limits this privilege to administrators. The flaw does not permit file writes and does not expose environment variables. This issue is fixed in version 26.1.1."}], "source": {"advisory": "GHSA-r8vq-5875-cq97", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T18:38:31.558889Z", "id": "CVE-2026-81190", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T18:38:50.304Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-81190", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T18:38:31.558889Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T18:38:41.501Z"}}], "cna": {"title": "KurrentDB: Privileged access to read $all enables arbitrary file read and GET-only SSRF", "source": {"advisory": "GHSA-r8vq-5875-cq97", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "kurrent-io", "product": "KurrentDB", "versions": [{"status": "affected", "version": "= 26.1.0"}]}], "references": [{"url": "https://github.com/kurrent-io/KurrentDB/security/advisories/GHSA-r8vq-5875-cq97", "name": "https://github.com/kurrent-io/KurrentDB/security/advisories/GHSA-r8vq-5875-cq97", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/kurrent-io/KurrentDB/pull/5674", "name": "https://github.com/kurrent-io/KurrentDB/pull/5674", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/kurrent-io/KurrentDB/commit/18706d0d5fcec5e2fbb0d20f76638d113b5842c8", "name": "https://github.com/kurrent-io/KurrentDB/commit/18706d0d5fcec5e2fbb0d20f76638d113b5842c8", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/kurrent-io/KurrentDB/releases/tag/v26.1.1", "name": "https://github.com/kurrent-io/KurrentDB/releases/tag/v26.1.1", "tags": ["x_refsource_MISC"]}, {"url": "https://kurrentdb.kurrent.io/releases/kurrentdb-26-1-1-security-release", "name": "https://kurrentdb.kurrent.io/releases/kurrentdb-26-1-1-security-release", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "KurrentDB is a database engineered for modern software applications and event-driven architectures. In version 26.1.0, a user authorized to read the $all stream can use Secondary Indexing query capabilities to read arbitrary files accessible to the database process, enumerate directories, and issue HTTP GET requests from that process. The default configuration limits this privilege to administrators. The flaw does not permit file writes and does not expose environment variables. This issue is fixed in version 26.1.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-73", "description": "CWE-73: External Control of File Name or Path"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T20:52:19.064Z"}}}, "cveMetadata": {"cveId": "CVE-2026-81190", "state": "PUBLISHED", "dateUpdated": "2026-11-09T18:38:50.304Z", "dateReserved": "2026-08-26T16:26:08.968Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-11-05T20:52:19.064Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "KurrentDB", "vendor": "kurrent-io", "versions": [{"status": "affected", "version": "= 26.1.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "KurrentDB is a database engineered for modern software applications and event-driven architectures. In version 26.1.0, a user authorized to read the $all stream can use Secondary Indexing query capabilities to read arbitrary files accessible to the database process, enumerate directories, and issue HTTP GET requests from that process. The default configuration limits this privilege to administrators. The flaw does not permit file writes and does not expose environment variables. This issue is fixed in version 26.1.1."}], "id": "CVE-2026-81190", "lastModified": "2026-11-12T22:18:51.470", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-81190", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T18:38:31.558889Z", "version": "2.0.3"}}]}, "published": "2026-11-05T21:18:54.053", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/kurrent-io/KurrentDB/commit/18706d0d5fcec5e2fbb0d20f76638d113b5842c8"}, {"source": "security-advisories@github.com", "url": "https://github.com/kurrent-io/KurrentDB/pull/5674"}, {"source": "security-advisories@github.com", "url": "https://github.com/kurrent-io/KurrentDB/releases/tag/v26.1.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/kurrent-io/KurrentDB/security/advisories/GHSA-r8vq-5875-cq97"}, {"source": "security-advisories@github.com", "url": "https://kurrentdb.kurrent.io/releases/kurrentdb-26-1-1-security-release"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-73"}, {"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "KurrentDB: KurrentDB: Arbitrary file read via secondary indexing queries", "id": "2567796", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567796"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-73", "details": ["A flaw was found in KurrentDB. An authenticated user authorized to read event streams can abuse secondary indexing query functionality to read arbitrary files accessible to the database service. This issue also allows the user to enumerate local directories and initiate unauthorized network requests from the database host, leading to sensitive information disclosure."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-81190", "public_date": "2026-11-05T20:52:19Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-81190\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-81190\nhttps://github.com/kurrent-io/KurrentDB/commit/18706d0d5fcec5e2fbb0d20f76638d113b5842c8\nhttps://github.com/kurrent-io/KurrentDB/pull/5674\nhttps://github.com/kurrent-io/KurrentDB/releases/tag/v26.1.1\nhttps://github.com/kurrent-io/KurrentDB/security/advisories/GHSA-r8vq-5875-cq97\nhttps://kurrentdb.kurrent.io/releases/kurrentdb-26-1-1-security-release"], "statement": "This vulnerability is rated as Moderate impact because exploitation requires high privileges to query the restricted stream, significantly constraining the attack surface in standard deployments. In typical configurations, access to this stream is restricted to administrative accounts, preventing unprivileged users from abusing secondary indexing queries to traverse directories or inspect local database files. Additionally, the scope of impact is limited to read operations, precluding arbitrary file modification or exposure of process environment variables.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "26.1.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "KurrentDB", "source": "cna", "vendor": "kurrent-io"}, "product": "kurrentdb", "vendor": "kurrent-io"}], "created": "2026-11-05T22:30:17.932489+00:00", "updated": "2026-11-06T16:35:00.064377+00:00", "vendors": ["kurrent-io", "kurrent-io$PRODUCT$kurrentdb"]}