This issue arises in KurrentDB 26.1.0, where a user with permission to read the $all stream can exploit secondary indexing queries to read any file that the database process can access, list directories, and send HTTP GET requests via the database process. The vulnerability is classified under CWE‑73 for absolute path traversal and CWE‑918 for server‑side request forgery. While the flaw does not allow writing files or leaking environment variables, it permits reading sensitive data from the filesystem and initiating outbound GET‑only HTTP requests that may reach internal resources.

Affected systems include all installations of KurrentDB version 26.1.0. Versions 26.1.1 and newer contain the fix. The default policy grants read access to the $all stream only to administrators, but the bug allows even those users to read arbitrary files. Non‑administrator accounts that have been mistakenly granted this permission are also impacted.

The CVSS score is 6.9, indicating a high severity. EPSS data is unavailable, so exploitation probability cannot be quantified, and the vulnerability is not listed in CISA’s KEV catalog. The attacker requires authenticated access with the $all read privilege, typically an administrator role, and must leverage the database’s secondary indexing feature. Once accessed, an attacker could read confidential files or reach internal services via GET‑only SSRF. Mitigation involves upgrading or adjusting permissions.