Nornicdb: Improper Network Binding in NornicDB Bolt Server allows unauthorized remote access
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Nornicdb is a distributed low-latency, Graph+Vector, Temporal MVCC with all sub-ms HNSW search, graph traversal, and writes. Prior to version 1.0.42-hotfix, the --address CLI flag (and NORNICDB_ADDRESS / server.host config key) is plumbed through to the HTTP server correctly but never reaches the Bolt server config. The Bolt listener therefore always binds to the wildcard address (all interfaces), regardless of what the user configures. On a LAN, this exposes the graph database — with its default admin:password credentials — to any device sharing the network. This issue has been patched in version 1.0.42-hotfix.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| orneryd | NornicDB | before 1.0.42-hotfix | 1.0.42-hotfix | Patch available | CNA |
| — | github.com/orneryd/nornicdb (Go) | before 1.0.42-hotfix | 1.0.42-hotfix | Patch available | GHSA-2hp7-65r3-wv54 |
- NornicDB Vendororneryd Affected before 1.0.42-hotfix Fixed in 1.0.42-hotfix Patch available CNA
- github.com/orneryd/nornicdb (Go) Vendor— Affected before 1.0.42-hotfix Fixed in 1.0.42-hotfix Patch available GHSA-2hp7-65r3-wv54
Remediation
- Fix · CNA NornicDB (orneryd) Fixed in 1.0.42-hotfix
- Fix · GHSA-2hp7-65r3-wv54 github.com/orneryd/nornicdb (Go) Fixed in 1.0.42-hotfix Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-42072
- 2026-10-03 Alias added: GHSA-2hp7-65r3-wv54
References
Other 5
- https://github.com/orneryd/NornicDB/security/advisories/GHSA-2hp7-65r3-wv54
- https://github.com/orneryd/NornicDB/commit/adce4f9a9fc7b6aada07c0bfa2d737cd7a6efaca
- https://github.com/orneryd/NornicDB/releases/tag/v1.0.42
- https://github.com/orneryd/NornicDB
- https://github.com/orneryd/NornicDB/releases/tag/v1.0.42-hotfix
More orneryd vulnerabilities
- TI-2026-70689 Missing authorization in NornicDB search endpoints exposes node data CVSS 4.0HIGH 7.1
Sources
- CVE-2026-42072 · CVE Program
- CVE-2026-42072 · NVD
- FIRST EPSS
- GHSA-2hp7-65r3-wv54 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences