{"id":"CVE-2026-42072","aliases":["GHSA-2hp7-65r3-wv54","GO-2026-4967"],"url":"https://o3.security/vulnerability/CVE-2026-42072","summary":"Nornicdb: Improper Network Binding in NornicDB Bolt Server allows unauthorized remote access","details":"## Summary\n\nThe `--address` CLI flag (and `NORNICDB_ADDRESS` / `server.host` config key) is plumbed through to the HTTP server correctly but **never reaches the Bolt server config**. The Bolt listener therefore always binds to the wildcard address (all interfaces), regardless of what the user configures.\n\nOn a LAN, this exposes the graph database — with its default `admin:password` credentials — to any device sharing the network.\n\n## Version\n\n- `nornicdb v1.0.39`\n- Built from commit `afe7c9d` on `main`\n- Platform: macOS (darwin 25.4.0, arm64)\n\n## Reproduction\n\n```\n$ nornicdb serve --address 127.0.0.1 --bolt-port 7687 --http-port 7474 ...\n```\n\nOutput claims Bolt is on localhost:\n```\nBolt server listening on bolt://localhost:7687\n```\n\nBut the actual socket:\n```\n$ netstat -an -p tcp | grep 7687\ntcp46      0      0  *.7687                 *.*                    LISTEN\n\n$ lsof -iTCP:7687 -sTCP:LISTEN -n -P\nnornicdb ... IPv6 ... TCP *:7687 (LISTEN)\n```\n\nHTTP port is correctly bound:\n```\ntcp4  127.0.0.1.7474   *.*  LISTEN\n```\n\nReachable from another host on the LAN:\n```\n$ nc -z 192.168.x.y 7687\nConnection to 192.168.x.y port 7687 [tcp/*] succeeded!\n```\n\nSetting `NORNICDB_BOLT_ADDRESS=127.0.0.1` or `server.host: \"127.0.0.1\"` in `config.yaml` has **no effect** on the Bolt listener.\n\n## Root Cause\n\nIn `pkg/bolt/server.go:774-776`:\n\n```go\nfunc (s *Server) ListenAndServe() error {\n    addr := fmt.Sprintf(\":%d\", s.config.Port)\n    listener, err := net.Listen(\"tcp\", addr)\n    ...\n}\n```\n\n`bolt.Config` (line 474) has no `Host`/`Address`/`Addr` field — only `Port`. The CLI flag `--address` is stored in a local variable in `cmd/nornicdb/main.go:80` and used to format user-facing log output (line 637–644), but is never copied into `boltConfig` at line 600–609 when Bolt is initialized.\n\nSince `ListenAndServe` calls `net.Listen(\"tcp\", \":7687\")` with an empty host, Go binds the wildcard socket on all interfaces.\n\n## Suggested Fix\n\n1. Add a `Host string` field to `bolt.Config` (default `\"127.0.0.1\"`, matching the CLI flag default).\n2. In `cmd/nornicdb/main.go` around line 601, wire it through:\n   ```go\n   boltConfig.Host = address\n   boltConfig.Port = boltPort\n   ```\n3. In `pkg/bolt/server.go:775`, use the host:\n   ```go\n   addr := net.JoinHostPort(s.config.Host, strconv.Itoa(s.config.Port))\n   ```\n\n## Security Impact\n\n- Default `admin:password` credentials + wildcard binding = anyone on the same WiFi can issue arbitrary Cypher queries (read, write, delete nodes) against NornicDB instances running with default setup.\n- Users following the README will reasonably assume `--address 127.0.0.1` (the documented default) binds *both* protocols to localhost.\n- Workaround: host-firewall rules (e.g. macOS `pf`) blocking non-loopback → 7687. Not discoverable from the docs.","published":"2026-05-08T15:59:42.544Z","modified":"2026-08-12T03:51:49.243274406Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.0044,"percentile":0.36456,"asOf":"2026-08-14"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/orneryd/nornicdb","fixedVersion":"1.0.42-hotfix"}],"fix":{"url":"https://github.com/orneryd/NornicDB/commit/adce4f9a9fc7b6aada07c0bfa2d737cd7a6efaca","label":"orneryd/NornicDB@adce4f9"},"references":[{"type":"WEB","url":"https://github.com/orneryd/NornicDB/releases/tag/v1.0.42"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42072.json"},{"type":"ADVISORY","url":"https://github.com/orneryd/NornicDB/security/advisories/GHSA-2hp7-65r3-wv54"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42072"},{"type":"FIX","url":"https://github.com/orneryd/NornicDB/commit/adce4f9a9fc7b6aada07c0bfa2d737cd7a6efaca"},{"type":"PACKAGE","url":"https://github.com/orneryd/NornicDB"},{"type":"WEB","url":"https://github.com/orneryd/NornicDB/releases/tag/v1.0.42-hotfix"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:49.243274406Z"}}