KurrentDB $all stream access enables arbitrary file read and SSRF
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-73 and the CVSS impact.
Summary
KurrentDB version 26.1.0 is affected. Secondary Indexing query capabilities let a user with read access to the $all stream read arbitrary files and enumerate directories accessible to the database process (CWE-73). That user can also issue HTTP GET requests from the server process. The default configuration limits this privilege to administrators, and the flaw does not allow file writes or expose environment variables.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
KurrentDB is a database engineered for modern software applications and event-driven architectures. In version 26.1.0, a user authorized to read the $all stream can use Secondary Indexing query capabilities to read arbitrary files accessible to the database process, enumerate directories, and issue HTTP GET requests from that process. The default configuration limits this privilege to administrators. The flaw does not permit file writes and does not expose environment variables. This issue is fixed in version 26.1.1.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| kurrent-io | KurrentDB | = 26.1.0 | — | No fix listed | CNA |
- KurrentDB Vendorkurrent-io Affected = 26.1.0 Fixed in — No fix listed CNA
Remediation
Upgrade KurrentDB to version 26.1.1, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Vendor assessments
Timeline
- 2026-11-05 Threatist record created from CVE-2026-81190
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
- 2026-11-07 Priority changed: MEDIUM → LOW
References
Other 5
- https://github.com/kurrent-io/KurrentDB/security/advisories/GHSA-r8vq-5875-cq97
- https://github.com/kurrent-io/KurrentDB/pull/5674
- https://github.com/kurrent-io/KurrentDB/commit/18706d0d5fcec5e2fbb0d20f76638d113b5842c8
- https://github.com/kurrent-io/KurrentDB/releases/tag/v26.1.1
- https://kurrentdb.kurrent.io/releases/kurrentdb-26-1-1-security-release
Sources
- CVE-2026-81190 · CVE Program
- CVE-2026-81190 · NVD
- FIRST EPSS
- CVE-2026-81190 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences