ArcadeDB CVE-2026-67340

Exploitation requires a valid ArcadeDB account that has been explicitly granted the UPDATE_SCHEMA permission, which corresponds to schema-administration rights one privilege tier below full security administration (UPDATE_SECURITY). The attacker must be able to reach the ArcadeDB API endpoint over the network and issue a CREATE TRIGGER SQL statement specifying JavaScript as the trigger language. Once the trigger is created, it fires automatically whenever a matching database operation occurs - no further attacker interaction is needed. The primary limiting factor is the UPDATE_SCHEMA credential requirement: deployments where this permission is granted only to a small set of tightly controlled accounts face substantially reduced real-world risk. There is no default configuration that prevents the java.lang.* host-class lookup path short of either upgrading to 26.7.2 or disabling JavaScript trigger scripting entirely.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) captures a network-reachable, low-complexity exploit path that yields full confidentiality, integrity, and availability compromise of the vulnerable system, gated only by the PR:H requirement for UPDATE_SCHEMA credentials. EPSS is 0.52% at the 41st percentile and SSVC records exploitation status as none, meaning no confirmed active exploitation, consistent with the absence of a CISA KEV listing. However, SSVC simultaneously flags automatable:yes and technical impact:total - meaning that once an attacker controls a qualifying account, the path to OS RCE is mechanically straightforward with no timing or race constraints. The low EPSS reflects the credential barrier rather than any technical difficulty in exploitation; even a mid-sized municipal IT team in zabrze should treat this as urgent if UPDATE_SCHEMA is granted to service accounts or shared credentials. The provided CVSS 4.0 vector sets SC/SI/SA to N, which underrepresents the host-OS escape potential - OS command execution via Runtime.exec() extends impact beyond the ArcadeDB process boundary. No public exploit code has been identified at time of analysis, but the GHSA advisory publishes specific code locations and a working exploitation pattern.

An attacker with UPDATE_SCHEMA credentials - obtained through credential reuse, a compromised service account, or insider access - connects to ArcadeDB's network API and issues a CREATE TRIGGER statement embedding a JavaScript payload that calls Java.type('java.lang.Runtime').getRuntime().exec() with attacker-supplied arguments such as a reverse shell command. When any database operation matching the trigger predicate subsequently fires (e.g., an INSERT or UPDATE on the targeted table), the OS command executes server-side with the privileges of the ArcadeDB process. No public exploit code has been identified at time of analysis, but the GHSA advisory provides sufficient implementation-level detail that reproduction by a capable actor is straightforward.