https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T12:41:36.703576+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-316822 EUVD-2026-316822 2026-10-07T12:41:36.706632+00:00 EUVD-2026-316822 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42072 fkie_cve-2026-42072 2026-10-07T12:41:36.706664+00:00

Nornicdb is a distributed low-latency, Graph+Vector, Temporal MVCC with all sub-ms HNSW search, graph traversal, and writes. Prior to version 1.0.42-hotfix, the --address CLI flag (and NORNICDB_ADDRESS / server.host config key) is plumbed through to the HTTP server correctly but never reaches the Bolt server config. The Bolt listener therefore always binds to the wildcard address (all interfaces), regardless of what the user configures. On a LAN, this exposes the graph database — with its default admin:password credentials — to any device sharing the network. This issue has been patched in version 1.0.42-hotfix.

 https://cve.radiocsirt.org/vuln/ghsa-2hp7-65r3-wv54 GHSA-2hp7-65r3-wv54 — NornicDB has Improper Network Binding in its Bolt Server, allowing unauthorized remote access 2026-10-07T12:41:36.706700+00:00

Affected: Go: github.com/orneryd/nornicdb

## Summary

The `--address` CLI flag (and `NORNICDB_ADDRESS` / `server.host` config key) is plumbed through to the HTTP server correctly but **never reaches the Bolt server config**. The Bolt listener therefore always binds to the wildcard address (all interfaces), regardless of what the user configures.

On a LAN, this exposes the graph database — with its default `admin:password` credentials — to any device sharing the network.

## Version

- `nornicdb v1.0.39` - Built from commit `afe7c9d` on `main` - Platform: macOS (darwin 25.4.0, arm64)

## Reproduction

``` $ nornicdb serve --address 127.0.0.1 --bolt-port 7687 --http-port 7474 ... ```

Output claims Bolt is on localhost: ``` Bolt server listening on bolt://localhost:7687 ```

But the actual socket: ``` $ netstat -an -p tcp | grep 7687 tcp46 0 0 *.7687 *.* LISTEN

$ lsof -iTCP:7687 -sTCP:LISTEN -n -P nornicdb ... IPv6 ... TCP *:7687 (LISTEN) ```

HTTP port is correctly bound: ``` tcp4 127.0.0.1.7474 *.* LISTEN ```

Reachable from another host on the LAN: ``` $ nc -z 192.168.x.y 7687 Connection to 192.168.x.y port 7687 [tcp/*] succeeded! ```

Setting `NORNICDB_BOLT_ADDRESS=127.0.0.1` or `server.host: "127.0.0.1"` in `config.yaml` has **no effect** on the Bolt listener.

## Root Cause

In `pkg/bolt/server.go:774-776`:

```go func (s *Server) ListenAndServe() error { addr := fmt.Sprintf(":%d", s.config.Port) listener, err := net.Listen("tcp", addr) ... } ```

`…