EUVD-2026-316822

fkie_cve-2026-42072

Nornicdb is a distributed low-latency, Graph+Vector, Temporal MVCC with all sub-ms HNSW search, graph traversal, and writes. Prior to version 1.0.42-hotfix, the --address CLI flag (and NORNICDB_ADDRESS / server.host config key) is plumbed through to the HTTP server correctly but never reaches the Bolt server config. The Bolt listener therefore always binds to the wildcard address (all interfaces), regardless of what the user configures. On a LAN, this exposes the graph database — with its default admin:password credentials — to any device sharing the network. This issue has been patched in version 1.0.42-hotfix.

GHSA-2hp7-65r3-wv54 — NornicDB has Improper Network Binding in its Bolt Server, allowing unauthorized remote access

Affected: Go: github.com/orneryd/nornicdb

## Summary

The `--address` CLI flag (and `NORNICDB_ADDRESS` / `server.host` config key) is plumbed through to the HTTP server correctly but **never reaches the Bolt server config**. The Bolt listener therefore always binds to the wildcard address (all interfaces), regardless of what the user configures.

On a LAN, this exposes the graph database — with its default `admin:password` credentials — to any device sharing the network.

## Version

- `nornicdb v1.0.39` - Built from commit `afe7c9d` on `main` - Platform: macOS (darwin 25.4.0, arm64)

## Reproduction

``` $ nornicdb serve --address 127.0.0.1 --bolt-port 7687 --http-port 7474 ... ```

Output claims Bolt is on localhost: ``` Bolt server listening on bolt://localhost:7687 ```

But the actual socket: ``` $ netstat -an -p tcp | grep 7687 tcp46 0 0 *.7687 *.* LISTEN

$ lsof -iTCP:7687 -sTCP:LISTEN -n -P nornicdb ... IPv6 ... TCP *:7687 (LISTEN) ```

HTTP port is correctly bound: ``` tcp4 127.0.0.1.7474 *.* LISTEN ```

Reachable from another host on the LAN: ``` $ nc -z 192.168.x.y 7687 Connection to 192.168.x.y port 7687 [tcp/*] succeeded! ```

Setting `NORNICDB_BOLT_ADDRESS=127.0.0.1` or `server.host: "127.0.0.1"` in `config.yaml` has **no effect** on the Bolt listener.

## Root Cause

In `pkg/bolt/server.go:774-776`:

```go func (s *Server) ListenAndServe() error { addr := fmt.Sprintf(":%d", s.config.Port) listener, err := net.Listen("tcp", addr) ... } ```

`…

Most recent entries from all

EUVD-2026-316822

fkie_cve-2026-42072

GHSA-2hp7-65r3-wv54 — NornicDB has Improper Network Binding in its Bolt Server, allowing unauthorized remote access