CVE-2026-42072: Nornicdb Information Disclosure Bug

CVE-2026-42072 Overview

CVE-2026-42072 is a configuration flaw in NornicDB, a distributed graph and vector database with temporal MVCC, sub-millisecond HNSW search, and graph traversal capabilities. Versions prior to 1.0.42-hotfix fail to apply the --address CLI flag, the NORNICDB_ADDRESS environment variable, and the server.host config key to the Bolt server. The Bolt listener always binds to the wildcard address (0.0.0.0), ignoring user-specified bind addresses. Any device on the same network can reach the graph database using the default admin:password credentials. The issue is patched in version 1.0.42-hotfix.

Critical Impact
An unauthenticated network attacker can reach the Bolt interface and log in with default credentials, gaining full read and write access to the graph database.

Affected Products

NornicDB versions prior to 1.0.42-hotfix
Deployments using the --address CLI flag for Bolt binding
Deployments relying on NORNICDB_ADDRESS or server.host configuration

Discovery Timeline

2026-05-08 - CVE-2026-42072 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-42072

Vulnerability Analysis

The vulnerability stems from inconsistent configuration plumbing between two server components inside NornicDB. The --address CLI flag, the NORNICDB_ADDRESS environment variable, and the server.host configuration key correctly propagate to the HTTP server. The same values never reach the Bolt server configuration. The Bolt listener therefore falls back to binding all interfaces, regardless of operator intent. Combined with the product's default admin:password credentials, this exposes the full graph database to any LAN-resident attacker.

The weakness is classified under [CWE-1392] (Use of Default Credentials) and compounds an insecure default with a missing security constraint on the network listener.

Root Cause

The Bolt server initialization path ignores the address resolved from CLI, environment, and config sources. Even when an administrator restricts the bind to 127.0.0.1 or a specific interface, the Bolt subsystem constructs its listener using the wildcard default. The HTTP server path applies the resolved address correctly, masking the inconsistency during typical testing.

Attack Vector

An attacker on the same Layer 2 or routed LAN segment scans for the default Bolt port and connects directly. Because authentication accepts the unchanged default credentials, the attacker reads, modifies, or deletes graph and vector data. The attacker can also use write access to pivot into application logic that trusts the database contents. No user interaction or prior privileges are required.

Technical details and the corrective change are documented in the GitHub Security Advisory GHSA-2hp7-65r3-wv54 and the GitHub Commit Changes.

Detection Methods for CVE-2026-42072

Indicators of Compromise

Bolt listener observed bound to 0.0.0.0 on hosts where --address or server.host was set to a loopback or private address
Successful Bolt authentication events using the admin account from unexpected LAN source addresses
Unexpected graph mutations, node deletions, or schema changes outside of application-driven workflows
New outbound connections from application hosts to the Bolt port originating from non-application IPs

Detection Strategies

Inventory all NornicDB hosts and verify the running version against 1.0.42-hotfix or later
Run ss -ltnp or netstat -an on each NornicDB host and confirm the Bolt port is not bound to 0.0.0.0 when a non-wildcard address was configured
Correlate Bolt authentication logs with expected application source IPs to surface unauthorized clients

Monitoring Recommendations

Forward NornicDB authentication and query logs to a centralized SIEM for anomaly review
Alert on any Bolt session authenticated with the admin user from a non-allowlisted IP range
Monitor network flow records for connections to the Bolt port from hosts outside the application tier

How to Mitigate CVE-2026-42072

Immediate Actions Required

Upgrade NornicDB to version 1.0.42-hotfix or later on every node
Rotate the admin password and remove the default admin:password credential immediately
Restrict Bolt port access at the host firewall or network ACL to known application sources
Audit Bolt authentication logs since the database was first deployed for unauthorized access

Patch Information

The fix is available in NornicDB 1.0.42-hotfix. The patch routes the resolved bind address from CLI, environment, and config sources into the Bolt server configuration so the listener honors the configured interface. See the GitHub Release v1.0.42 and the corresponding GitHub Commit Changes for the code change.

Workarounds

Block the Bolt port at the OS firewall (iptables, nftables, or ufw) so only trusted application hosts can connect
Place NornicDB nodes on an isolated management VLAN with no client device reachability
Replace default credentials before exposing the service to any non-loopback interface

bash

# Configuration example
# Restrict Bolt access until upgrade is complete (Linux nftables)
nft add rule inet filter input tcp dport 7687 ip saddr != 10.0.1.0/24 drop

# Upgrade NornicDB to the patched release
# (replace with your installation method)
# docker pull orneryd/nornicdb:1.0.42-hotfix