CVE-2026-115646

Summary

HiRDB contains a partial string comparison vulnerability (CWE-187) that may allow an unauthenticated remote attacker to bypass authentication or authorization checks by exploiting incomplete string validation during credential or permission verification. This flaw is critical due to its network-exploitable nature and full confidentiality, integrity, and availability impact.

Exploitability

Exploitation requires no prior access, user interaction, or special conditions, but the exact attack vector remains unspecified in the public description.

Blast radius

Successful exploitation could enable full system compromise including unauthorized data access, modification, or service disruption across all affected HiRDB instances.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade HiRDB Server Version 10 to 10-12-01 or later; upgrade HiRDB Server Version 9 to a version newer than 09-66-22; upgrade HiRDB Server with Additional Function Version 9 to a version newer than 09-66-/V; upgrade HiRDB Server Version 9(32) to a version newer than 09-66-22; upgrade HiRDB Server with Additional Function Version 9(32) to a version newer than 09-66-/V.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.