CVE-2026-42072: NornicDB has Improper Network Binding in its Bolt Server, allowing unauthorized remote access

The --address CLI flag (and NORNICDB_ADDRESS / server.host config key) is plumbed through to the HTTP server correctly but never reaches the Bolt server config. The Bolt listener therefore always binds to the wildcard address (all interfaces), regardless of what the user configures.

On a LAN, this exposes the graph database — with its default admin:password credentials — to any device sharing the network.