CVE-2026-42072: Github.com/orneryd/nornicdb NornicDB Has Improper Network Binding Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-2hp7-65r3-wv54",
  "modified" : "2026-05-13T13:30:30Z",
  "published" : "2026-04-22T22:03:43Z",
  "aliases" : [ "CVE-2026-42072" ],
  "summary" : "NornicDB has Improper Network Binding in its Bolt Server, allowing unauthorized remote access",
  "details" : "## Summary\n\nThe `--address` CLI flag (and `NORNICDB_ADDRESS` / `server.host` config key) is plumbed through to the HTTP server correctly but **never reaches the Bolt server config**. The Bolt listener therefore always binds to the wildcard address (all interfaces), regardless of what the user configures.\n\nOn a LAN, this exposes the graph database — with its default `admin:password` credentials — to any device sharing the network.\n\n## Version\n\n- `nornicdb v1.0.39`\n- Built from commit `afe7c9d` on `main`\n- Platform: macOS (darwin 25.4.0, arm64)\n\n## Reproduction\n\n```\n$ nornicdb serve --address 127.0.0.1 --bolt-port 7687 --http-port 7474 ...\n```\n\nOutput claims Bolt is on localhost:\n```\nBolt server listening on bolt://localhost:7687\n```\n\nBut the actual socket:\n```\n$ netstat -an -p tcp | grep 7687\ntcp46      0      0  *.7687                 *.*                    LISTEN\n\n$ lsof -iTCP:7687 -sTCP:LISTEN -n -P\nnornicdb ... IPv6 ... TCP *:7687 (LISTEN)\n```\n\nHTTP port is correctly bound:\n```\ntcp4  127.0.0.1.7474   *.*  LISTEN\n```\n\nReachable from another host on the LAN:\n```\n$ nc -z 192.168.x.y 7687\nConnection to 192.168.x.y port 7687 [tcp/*] succeeded!\n```\n\nSetting `NORNICDB_BOLT_ADDRESS=127.0.0.1` or `server.host: \"127.0.0.1\"` in `config.yaml` has **no effect** on the Bolt listener.\n\n## Root Cause\n\nIn `pkg/bolt/server.go:774-776`:\n\n```go\nfunc (s *Server) ListenAndServe() error {\n    addr := fmt.Sprintf(\":%d\", s.config.Port)\n    listener, err := net.Listen(\"tcp\", addr)\n    ...\n}\n```\n\n`bolt.Config` (line 474) has no `Host`/`Address`/`Addr` field — only `Port`. The CLI flag `--address` is stored in a local variable in `cmd/nornicdb/main.go:80` and used to format user-facing log output (line 637–644), but is never copied into `boltConfig` at line 600–609 when Bolt is initialized.\n\nSince `ListenAndServe` calls `net.Listen(\"tcp\", \":7687\")` with an empty host, Go binds the wildcard socket on all interfaces.\n\n## Suggested Fix\n\n1. Add a `Host string` field to `bolt.Config` (default `\"127.0.0.1\"`, matching the CLI flag default).\n2. In `cmd/nornicdb/main.go` around line 601, wire it through:\n   ```go\n   boltConfig.Host = address\n   boltConfig.Port = boltPort\n   ```\n3. In `pkg/bolt/server.go:775`, use the host:\n   ```go\n   addr := net.JoinHostPort(s.config.Host, strconv.Itoa(s.config.Port))\n   ```\n\n## Security Impact\n\n- Default `admin:password` credentials + wildcard binding = anyone on the same WiFi can issue arbitrary Cypher queries (read, write, delete nodes) against NornicDB instances running with default setup.\n- Users following the README will reasonably assume `--address 127.0.0.1` (the documented default) binds *both* protocols to localhost.\n- Workaround: host-firewall rules (e.g. macOS `pf`) blocking non-loopback → 7687. Not discoverable from the docs.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/orneryd/nornicdb"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.0.42-hotfix"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/orneryd/NornicDB/security/advisories/GHSA-2hp7-65r3-wv54"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-42072"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/orneryd/NornicDB/commit/adce4f9a9fc7b6aada07c0bfa2d737cd7a6efaca"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/orneryd/NornicDB"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/orneryd/NornicDB/releases/tag/v1.0.42"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/orneryd/NornicDB/releases/tag/v1.0.42-hotfix"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-1392" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-22T22:03:43Z",
    "nvd_published_at" : "2026-05-08T17:16:31Z"
  }
}