{"cve":"CVE-2026-42072","nvd":{"published":"2026-05-08T17:16:31.447","modified":"2026-10-26T18:10:00.173","status":"Deferred","description":"Nornicdb is a distributed low-latency, Graph+Vector, Temporal MVCC with all sub-ms HNSW search, graph traversal, and writes. Prior to version 1.0.42-hotfix, the --address CLI flag (and NORNICDB_ADDRESS / server.host config key) is plumbed through to the HTTP server correctly but never reaches the Bolt server config. The Bolt listener therefore always binds to the wildcard address (all interfaces), regardless of what the user configures. On a LAN, this exposes the graph database — with its default admin:password credentials — to any device sharing the network. This issue has been patched in version 1.0.42-hotfix.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-1392"],"references":["https://github.com/orneryd/NornicDB/commit/adce4f9a9fc7b6aada07c0bfa2d737cd7a6efaca","https://github.com/orneryd/NornicDB/releases/tag/v1.0.42","https://github.com/orneryd/NornicDB/security/advisories/GHSA-2hp7-65r3-wv54"],"products":[],"source":"nvd","synced_at":"2026-10-26T18:27:13.530666824+00:00"},"epss":{"cve":"CVE-2026-42072","score":0.0044,"percentile":0.37955,"date":"2026-10-26"},"kev":null,"osv":[{"id":"GHSA-2hp7-65r3-wv54","url":"https://osv.dev/vulnerability/GHSA-2hp7-65r3-wv54","summary":"NornicDB has Improper Network Binding in its Bolt Server, allowing unauthorized remote access","modified":"2026-05-20T19:41:02.281478581Z","packages":[{"ecosystem":"Go","name":"github.com/orneryd/nornicdb","purl":"pkg:golang/github.com/orneryd/nornicdb","ranges":["<1.0.42-hotfix"],"fixed":["1.0.42-hotfix"]}]},{"id":"GO-2026-4967","url":"https://osv.dev/vulnerability/GO-2026-4967","summary":"NornicDB has Improper Network Binding in its Bolt Server, allowing unauthorized remote access in github.com/orneryd/nornicdb","modified":"2026-05-20T19:30:12.961117673Z","packages":[{"ecosystem":"Go","name":"github.com/orneryd/nornicdb","purl":"pkg:golang/github.com/orneryd/nornicdb","ranges":["<1.0.42-hotfix"],"fixed":["1.0.42-hotfix"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}