ArcadeDB CVE-2026-119577

Exploitation requires the attacker to already be an authenticated ArcadeDB user who opened a wire-protocol connection (Postgres, Bolt, MongoDB, or Redis) BEFORE their access was changed, and to keep that exact connection open; the affected wire-protocol listener modules (arcadedb-postgresw, arcadedb-bolt, arcadedb-mongodbw, arcadedb-redisw) must be enabled. Limiting factors: new logins with the revoked credentials are refused, the HTTP API enforces the revocation immediately, and a group narrowing with no password change IS already enforced on wire connections - so the exposure is strictly confined to pre-existing open wire connections affected by user deletion, grant removal, or password rotation. There is no remote-unauthenticated path (PR:L).

This is a post-revocation session-persistence flaw (CWE-613/CWE-863), and the signals point to a moderate, targeted risk rather than a mass-exploitation emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H) scores 7.6: PR:L confirms the actor must already be an authenticated user, and AT:P reflects a genuine precondition - the attacker must hold a wire-protocol connection opened BEFORE access was revoked, since new logins with the revoked credentials are refused. There is no CISA KEV listing, so the exploitation-status phrase 'confirmed actively exploited' does not apply, and no EPSS probability was supplied, so I cannot quantify likelihood; the vuln.today decision label is 'this_week' (not act_now/emergency). The GHSA advisory documents a step-by-step reproduction, so a public PoC reference exists but it is not verified as working exploit code. Net: the realistic threat model is a departed or compromised insider whose revocation an administrator believes took effect but did not - high confidentiality/integrity impact on affected data, but bounded to connections already open, not wormable or remotely unauthenticated. Treat as a real priority for environments exposing ArcadeDB wire protocols with active user-lifecycle churn, but not a drop-everything internet-wide event.

A database user authenticates to ArcadeDB over one of the Postgres, Bolt, MongoDB, or Redis wire protocols and keeps that connection open. An administrator later deletes the user, removes its database grant, or rotates its password and narrows its group - yet the attacker continues reading and writing data on the still-open connection, even though the same credentials are immediately rejected on the HTTP API. The GHSA advisory includes a reproduction procedure (public PoC reference, not verified as working exploit code), and because PR:L applies, the actor must have been a legitimately authenticated user before revocation.