KurrentDB: Privileged access to read $all enables arbitrary file read and GET-only SSRF

published 2026-11-05 3 d ago modified 2026-11-05 3 d ago also EUVD-2026-117797

cvss: 6.9; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 19%
public exploits: 0; none known

KurrentDB is a database engineered for modern software applications and event-driven architectures. In version 26.1.0, a user authorized to read the $all stream can use Secondary Indexing query capabilities to read arbitrary files accessible to the database process, enumerate directories, and issue HTTP GET requests from that process. The default configuration limits this privilege to administrators. The flaw does not permit file writes and does not expose environment variables. This issue is fixed in version 26.1.1.

Patch / fix

links 3

github.com/kurrent-io/KurrentDB@18706d0 commit
github.com/kurrent-io/KurrentDB#5674 pull request
github.com/kurrent-io/KurrentDB/releases/tag/v26.1.1 release

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-81190 updated 2026-11-06 cvss 4.9

KurrentDB: KurrentDB: Arbitrary file read via secondary indexing queries

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CNA	4.0	6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

kurrent-io KurrentDB

Classification

Weakness

CWE-73 External Control of File Name or Path
CWE-918 Server-Side Request Forgery

References

Sources

CVE List CVE-2026-81190
NVD CVE-2026-81190

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary