CVE-2026-42072: NornicDB Bolt Server Binds to All Interfaces, Exposing the Graph Database on the Network

Overview

NornicDB is a distributed graph and vector database. According to the CVE description, before version 1.0.42-hotfix the --address CLI flag, the NORNICDB_ADDRESS variable and the server.host configuration key reach the HTTP server but not the Bolt server, so the Bolt listener always binds to all interfaces. The primary reference is the GitHub security advisory.

Impact

• The record assigns a CVSS 3.1 base score of 9.8 (critical), with network attack vector, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability.
• According to the description, any device on the same local network can reach the exposed listener.
• The description states that the default credentials are admin:password, which would make unauthorized access straightforward if the listener is reachable.
• The record maps the weakness to CWE-1392 (use of default credentials), although no CWE name is provided in the data.

Affected products and versions

• Product: NornicDB. The description states that versions prior to 1.0.42-hotfix are affected.
• The structured list of affected products is empty in the record, so the exact affected range is not formally enumerated.
• The fix is stated as 1.0.42-hotfix. The sources also reference a release page for v1.0.42, whose exact relationship to the hotfix build is not described in the record.

Exploitation status

This CVE is not listed in the CISA KEV catalog in the record. No confirmed exploitation appears in the sources consulted for this analysis.

Remediation and mitigation

• Upgrade NornicDB to 1.0.42-hotfix or a later build that includes the fix, as stated in the description. Review the release page and the fix commit to confirm the build you deploy.
• Until the upgrade is applied, restrict access to the Bolt port with host firewalls or network segmentation so that only trusted hosts can connect.
• Change any default credentials, since the description indicates that default admin:password credentials are part of the exposure.
• Do not expose the database to untrusted or unmanaged networks.

Detection guidance

• Inventory all NornicDB instances and confirm which network interfaces their database listeners are bound to.
• Review network segmentation and firewall rules for the database port from the perspective of the local network.
• Review authentication logs for connections from unexpected or unknown hosts.
• Scan your own assets for exposed database ports to verify that the listener is not reachable from unintended segments.

Limitations of the available information

• The record contains no structured affected or fixed version entries, so version ranges rely on the description text.
• The record has no product identifiers and no title; the title used here was written from the description.
• The default Bolt port number is not stated in the record.
• The relationship between the hotfix version and the v1.0.42 release tag is not explained in the record.
• EPSS data is present, but it does not confirm exploitation and is not a measure of actual attacks.

Frequently asked questions

What does CVE-2026-42072 affect?

According to the description, NornicDB versions before 1.0.42-hotfix are affected because the Bolt listener binds to all interfaces instead of the configured address.

What should administrators do?

Upgrade to 1.0.42-hotfix or later, restrict access to the Bolt port with firewalls or segmentation, and change any default credentials.

Is this vulnerability known to be exploited?

This CVE is not listed in the CISA KEV catalog in the record, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.