CVE-2024-26133

EventStoreDB (ESDB) is an operational database built to store events. A vulnerability has been identified in the projections subsystem in versions 20 prior to 20.10.6, 21 prior to 21.10.11, 22 prior to 22.10.5, and 23 prior to 23.10.1. Only database instances that use custom projections are affected by this vulnerability. User passwords may become accessible to those who have access to the chunk files on disk, and users who have read access to system streams. Only users in the `$admins` group can access system streams by default. ESDB 23.10.1, 22.10.5, 21.10.11, and 20.10.6 contain a patch for this issue. Users should upgrade EventStoreDB, reset the passwords for current and previous members of `$admins` and `$ops` groups, and, if a password was reused in any other system, reset it in those systems to a unique password to follow best practices. If an upgrade cannot be done immediately, reset the passwords for current and previous members of `$admins` and `$ops` groups. Avoid creating custom projections until the patch has been applied.

• CWE-256
• CWE-522

• https://developers.eventstore.com/cloud/ops/#upgrading-eventstoredb-versionProduct
• https://developers.eventstore.com/server/v22.10/upgrade-guide.html#upgrade-guide-for-eventstoredb-22-10Release Notes
• https://github.com/EventStore/EventStore/commit/6d4edee18c7fe886abffe58fa1f97d72681b24bfPatch
• https://github.com/EventStore/EventStore/security/advisories/GHSA-6r53-v8hj-x684Vendor Advisory
• https://www.eventstore.com/blog/eventstoredb-security-release-23.10-22.10-21.10-and-20.10-for-cve-2024-26133Broken Link
• https://www.eventstore.com/blog/new-version-strategyBroken Link
• https://developers.eventstore.com/cloud/ops/#upgrading-eventstoredb-versionProduct
• https://developers.eventstore.com/server/v22.10/upgrade-guide.html#upgrade-guide-for-eventstoredb-22-10Release Notes
• https://github.com/EventStore/EventStore/commit/6d4edee18c7fe886abffe58fa1f97d72681b24bfPatch
• https://github.com/EventStore/EventStore/security/advisories/GHSA-6r53-v8hj-x684Vendor Advisory
• https://www.eventstore.com/blog/eventstoredb-security-release-23.10-22.10-21.10-and-20.10-for-cve-2024-26133Broken Link
• https://www.eventstore.com/blog/new-version-strategyBroken Link

Published

Feb 21, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-26128baserCMS is a website development framework. Prior to versio…5.4
• CVE-2024-26129PrestaShop is an open-source e-commerce platform. Starting i…5.3
• CVE-2024-2613Data was not properly sanitized when decoding a QUIC ACK fra…7.5
• CVE-2024-26130cryptography is a package designed to expose cryptographic p…7.5
• CVE-2024-26131Element Android is an Android Matrix Client. Element Android…7.8
• CVE-2024-26132Element Android is an Android Matrix Client. A third-party m…3.3
• CVE-2024-26134cbor2 provides encoding and decoding for the Concise Binary …7.5
• CVE-2024-26135MeshCentral is a full computer management web site. Versions…8.8
• CVE-2024-26136kedi ElectronCord is a bot management tool for Discord. Comm…7.5
• CVE-2024-26138The XWiki licensor application, which manages and enforce ap…5.3
• CVE-2024-26139OpenCTI is an open source platform allowing organizations to…8.1
• CVE-2024-2614Memory safety bugs present in Firefox 123, Firefox ESR 115.8…8.8