The vulnerability arises when the Bolt listener in NornicDB fails to honor the configured address parameter, binding instead to the wildcard address on all network interfaces. This misconfiguration allows any host on the same network to reach the Bolt endpoint, which uses the database’s default credentials (admin:password). As a result, an unauthenticated or low‑privilege attacker can connect to the database and potentially execute arbitrary queries or commands via the Bolt protocol, depending on the database’s exposed capabilities. The weakness reflects improper access control, identified as CWE‑1392.

The flaw affects any NornicDB release prior to the 1.0.42‑hotfix update, including version 1.0.42 itself. The update addresses the binding issue, restoring the intended local‑only configuration.

With a CVSS score of 9.8, this flaw is considered critical. No EPSS score is available, but the lack of a KEV listing does not diminish the inherent risk of remote exploitation through a networked interface with default passwords. The most likely attack vector is a local network access to the Bolt port, where an attacker may attempt to authenticate with the known default credentials and then use the database interface to read, modify, or delete data.