CVE-2026-42072 - Vulnerability Analysis

Overview

Nornicdb < 1.0.42-hotfix contains a broken access control vulnerability caused by the Bolt server binding to all interfaces ignoring configured address, letting attackers on the LAN access the database with default admin credentials, exploit requires network access to LAN.

Severity & Score

Impact

Attackers on the LAN can access the database with default admin credentials, leading to full unauthorized access and control.

Mitigation

Update to version 1.0.42-hotfix or later.

References

• https://github.com/orneryd/NornicDB/commit/adce4f9a9fc7b6aada07c0bfa2d737cd7a6efaca
• https://github.com/orneryd/NornicDB/releases/tag/v1.0.42
• https://github.com/orneryd/NornicDB/security/advisories/GHSA-2hp7-65r3-wv54

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner