Missing authorization in NornicDB search endpoints exposes node data
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
NornicDB through 1.4.1 contains a missing authorization flaw (CWE-862) in its vector search endpoints. An authenticated user with the viewer role, allowlisted for a database but denied read on it, can bypass per-database read restrictions. Such a user can submit search queries or node IDs to retrieve node IDs, labels and full property maps.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
NornicDB through 1.4.1 contains a missing authorization vulnerability that allows authenticated users to bypass per-database read restrictions on the /nornicdb/search and /nornicdb/similar endpoints. Viewer-role users allowlisted for a database but denied read can submit search queries or node IDs to retrieve node IDs, labels and full property maps.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for NornicDB.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Vendor assessments
Timeline
- 2026-10-11 Threatist record created from CVE-2026-108710
- 2026-10-11 Alias added: GHSA-vqw4-fq22-hj9c
- 2026-10-12 Priority changed: MEDIUM → LOW
- 2026-10-13 CISA SSVC decision points changed
- 2026-10-13 Priority changed: LOW → MEDIUM
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
References
Other 4
- https://github.com/orneryd/NornicDB/blob/67105489e6da00714b998faf9012ffa44f526245/pkg/server/server_nornicdb.go#L415-L419
- https://github.com/orneryd/NornicDB/blob/67105489e6da00714b998faf9012ffa44f526245/pkg/server/server_nornicdb.go#L811-L815
- https://github.com/orneryd/NornicDB/blob/67105489e6da00714b998faf9012ffa44f526245/pkg/server/server_graph.go#L418-L423
- https://github.com/orneryd/NornicDB
More orneryd vulnerabilities
- TI-2026-30440 Nornicdb: Improper Network Binding in NornicDB Bolt Server allows unauthorized remote access CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-108710 · CVE Program
- CVE-2026-108710 · NVD
- FIRST EPSS
- GHSA-vqw4-fq22-hj9c · GitHub Advisory Database · CC BY 4.0
- CVE-2026-108710 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences