CVE-2026-42072: Nornicdb Exposes Graph Database via Default Credentials on LAN
The National Vulnerability Database has identified a critical vulnerability, CVE-2026-42072, affecting Nornicdb versions prior to 1.0.42-hotfix. The issue stems from the --address CLI flag and associated configuration keys not correctly reaching the Bolt server. This flaw causes the Bolt listener to default to binding to all network interfaces, regardless of user configuration. Consequently, on a local area network, Nornicdb instances are exposed with their default admin:password credentials, making the graph database accessible to any device on the same network segment.
This vulnerability carries a CVSS score of 9.8 (CRITICAL) and is categorized under CWE-1392. The lack of proper address binding means that any attacker with network access to the affected LAN can potentially gain unauthorized access to sensitive graph data. The implications are severe, as graph databases often store interconnected information critical to an organization’s operations or user relationships. The issue has since been patched in version 1.0.42-hotfix.
What This Means For You
- If your organization uses Nornicdb, immediately verify that you are running version 1.0.42-hotfix or later. For older versions, disconnect affected instances from untrusted networks or restrict network access to the Bolt port (default 7687) until patched. Audit network traffic for any unauthorized access attempts to Nornicdb instances.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-42072: Nornicdb Bolt Port Exposed on LAN
title: CVE-2026-42072: Nornicdb Bolt Port Exposed on LAN
id: scw-2026-05-08-ai-1
status: experimental
level: critical
description: |
Detects network connections to the Nornicdb Bolt port (7687) originating from private IP address ranges, indicating potential exposure on a local area network due to default credentials. This rule specifically targets the vulnerability described in CVE-2026-42072 where the Bolt listener binds to all interfaces regardless of configuration.
author: SCW Feed Engine (AI-generated)
date: 2026-05-08
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-42072/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: authentication
detection:
selection:
dst_port:
- 7687
src_ip|contains:
- '192.168.'
- '10.0.'
- '172.16.'
- '172.17.'
- '172.18.'
- '172.19.'
- '172.20.'
- '172.21.'
- '172.22.'
- '172.23.'
- '172.24.'
- '172.25.'
- '172.26.'
- '172.27.'
- '172.28.'
- '172.29.'
- '172.30.'
- '172.31.'
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-42072 | Misconfiguration | Nornicdb versions prior to 1.0.42-hotfix |
| CVE-2026-42072 | Information Disclosure | Nornicdb Bolt server binding to wildcard address (all interfaces) |
| CVE-2026-42072 | Auth Bypass | Nornicdb default credentials admin:password exposed on LAN |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 08, 2026 at 20:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-6667 — PgBouncer before 1.25.2 did not perform an appropriate
CVE-2026-6667 — PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command. All users with access to the administration console...
CVE-2026-6666 — A possible null pointer reference in PgBouncer before
CVE-2026-6666 — A possible null pointer reference in PgBouncer before 1.25.2 could lead to a crash, if a server sends an error response without SQLSTATE...
PgBouncer SCRAM Vulnerability (CVE-2026-6665) Allows Stack Overflow
CVE-2026-6665 — The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM...