CVSS 3.1 Score 5.5 of 10 (medium)


Published Feb 21, 2024
Updated: Feb 22, 2024
CWE ID 256


CVE-2024-26133 is a vulnerability found in the projections subsystem of EventStoreDB (ESDB) versions 20 prior to 20.10.6, 21 prior to 21.10.11, 22 prior to 22.10.5, and 23 prior to 23.10.1. Only database instances using custom projections are affected by this vulnerability. It allows unauthorized access to user passwords for those who can access chunk files on disk and have read access to system streams. Users in the `$admins` group can access system streams by default. The issue has been patched in ESDB versions 23.10.1, 22.10.5, 21.10.11, and 20.10.6, so upgrading is recommended along with resetting passwords for current and previous members of `$admins` and `$ops` groups as a best practice precautionary measure against potential misuse of compromised passwords in other systems if they were reused there as well. Note: The information provided here is based on the given text and does not involve any external research or additional sources beyond the provided text snippet

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.


Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future

Note: This is just a basic overview providing quick insights into CVE-2024-26133 information. Gain full access to comprehensive CVE data, third party vulnerabilities, compromised credentials and more with Recorded Future
  • Gain complete coverage of your cyber, third party, and physical attack surface
  • Proactively mitigate threats before they turn into costly attacks
  • Make fast, effective, data-driven decisions