CVE-2026-81190 in KurrentDB
Summary
by MITRE • 11/05/2026
KurrentDB is a database engineered for modern software applications and event-driven architectures. In version 26.1.0, a user authorized to read the $all stream can use Secondary Indexing query capabilities to read arbitrary files accessible to the database process, enumerate directories, and issue HTTP GET requests from that process. The default configuration limits this privilege to administrators. The flaw does not permit file writes and does not expose environment variables. This issue is fixed in version 26.1.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/05/2026
KurrentDB serves as a high-performance database solution designed for modern software applications, particularly those leveraging event-driven architectures. In its release cycle leading up to version 26.1.0, the system introduced Secondary Indexing capabilities intended to enhance query flexibility and performance. However, this feature contained a critical security flaw that allowed users with read access to the $all stream to exploit the indexing mechanism for unauthorized out-of-band actions. The vulnerability stems from an improper restriction of server-side functionality when processing secondary index queries, effectively bypassing standard input validation controls designed to limit database operations to data retrieval and manipulation within the defined schema boundaries.
The technical nature of this flaw constitutes a Server-Side Request Forgery combined with Local File Inclusion risks. By crafting specific Secondary Indexing query payloads, an authenticated user possessing read privileges on the $all stream could instruct the KurrentDB process to perform arbitrary file system operations. This included reading files accessible to the database service account and enumerating directory structures on the host machine. Furthermore, the vulnerability extended beyond local storage access by enabling the issuance of HTTP GET requests from within the context of the database server itself. This capability allows for network reconnaissance against internal services or exfiltration of data via external channels if outbound connectivity is permitted.
From an operational impact perspective, this vulnerability poses a severe risk to confidentiality and integrity in environments where administrative privileges are not strictly isolated or monitored. Although the default configuration restricts access to the $all stream primarily to administrators, any compromise of admin credentials or misconfiguration that grants broader read access could lead to significant data leakage. The ability to enumerate directories aids attackers in mapping the server environment, identifying sensitive files such as configuration documents, private keys, or other database dumps. While the flaw does not permit file writes nor expose environment variables directly, it provides a powerful foothold for further exploitation within the host operating system and internal network segments.
This vulnerability aligns with CWE-20 Improper Input Validation, specifically regarding insufficient verification of user-supplied data before processing by server-side components. It also maps to MITRE ATT&CK techniques related to Server-Side Request Forgery (T1571) and Data from Local System (T1083), as it facilitates unauthorized access to local file systems and internal network resources through a trusted application channel. The lack of strict output encoding or command separation in the secondary index query handler allowed these arbitrary actions to be executed under the database process identity, highlighting the importance of principle of least privilege and robust input sanitization in backend services.
To mitigate this risk, organizations running KurrentDB must immediately upgrade to version 26.1.1 where the flaw has been resolved by tightening the restrictions on secondary index query capabilities. In addition to patching, administrators should audit access controls for the $all stream to ensure that only essential administrative accounts retain read privileges. Network segmentation strategies should also be reviewed to limit the database server's ability to make outbound HTTP requests and restrict file system permissions so that even if an attacker gains execution context within the process, they cannot easily access sensitive files outside of a minimal required set. Regular security assessments focusing on input validation in query interfaces are recommended to prevent similar vulnerabilities in future updates or custom integrations.