ArcadeDB CVE-2026-67344

Exploitation requires a valid ArcadeDB credential with at minimum read-only database access - the CVE description explicitly names a read-only API token as sufficient. The attacker must be able to reach the ArcadeDB HTTP command endpoint over the network (or locally if the service is not exposed). No special database configuration, non-default feature flag, or elevated privilege beyond read access is required; this permission gap exists in the default permission model. Exploitation is strictly limited to authenticated users - unauthenticated attackers cannot trigger this bypass. Additionally, note that the AV:L designation in the provided CVSS 4.0 vector is inconsistent with the HTTP-based attack surface described; organizations should confirm the actual network exposure of their ArcadeDB command endpoint and treat AV:N as a plausible scenario until the vendor clarifies.

The provided CVSS 4.0 vector scores 8.5 (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N), but contains a notable internal inconsistency: AV:L (local attack vector) conflicts with the vulnerability description, which explicitly names the HTTP command endpoint as the attack surface - an interface that is typically network-accessible. Security teams should verify the actual attack vector with the vendor advisory before using this score for prioritization. Excluding that metric ambiguity, the vulnerability requires authenticated access (a read-only credential - PR:L), which meaningfully reduces the opportunistic exploitation surface compared to unauthenticated network flaws. No EPSS data was provided; the CVE is absent from CISA KEV; and no public POC code is referenced. Real-world impact is bounded by the database's role - schema corruption and misconfigured bucket routing can cause data loss or failed queries but do not directly enable code execution. For organizations where ArcadeDB schema integrity is operationally critical, this is a genuine patch priority, but it is not equivalent in urgency to a pre-auth remote code execution.

An attacker who has obtained a read-only ArcadeDB API token - through credential theft, insider access, or compromised automation - sends an HTTP POST to the database's command endpoint containing a crafted ALTER TYPE ... BUCKETSELECTIONSTRATEGY statement targeting a critical type. Because the UPDATE_SCHEMA permission check is absent, ArcadeDB applies the change, rerouting future record writes for that type to an incorrect bucket and silently corrupting data distribution. No public exploit code has been identified at time of analysis, but the attack requires only standard HTTP tooling and a valid credential.