EUVD-2026-60607
GHSA-pgf7-648w-96c5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable gRPC with only reader credentials (PR:L) and no interaction; JavaScript execution escapes the DB security context to compromise the whole server, so S:C and C/I/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run unrestricted JavaScript that creates server-wide administrator accounts.
AnalysisAI
Privilege escalation in ArcadeDB before 26.8.1 lets a low-privileged authenticated reader escalate to full server administrator via the gRPC transaction interface. Because the server fails to bind the authenticated principal to the gRPC transaction executor thread in beginTransaction, an attacker can call executeCommand with a valid transaction ID to run arbitrary JavaScript that bypasses scripting authorization, ultimately creating server-wide admin accounts. Reported by VulnCheck with a linked GitHub security advisory; no public exploit is identified at time of analysis, and the flaw carries a CVSS 4.0 base score of 9.4.
Technical ContextAI
ArcadeDB is a multi-model (graph, document, key-value, time-series) NoSQL database that exposes several remote transports, including an HTTP API and a gRPC API. The root cause is CWE-269 (Improper Privilege Management): the gRPC transaction executor runs commands on a separate thread pool, and beginTransaction does not propagate/bind the authenticated security principal onto that worker thread. As a result, when executeCommand is invoked with a transaction ID, the command executes in a context where the scripting authorization check - which normally restricts execution of JavaScript/server-side scripting to sufficiently privileged users - is not enforced. This lets a user with only read privileges execute unrestricted JavaScript inside the database engine, which in turn can manipulate the internal security model to provision new administrator principals. The affected CPE is cpe:2.3:a:arcadedata:arcadedb:*:*:*:*:*:*:*:*, covering all releases prior to 26.8.1.
RemediationAI
Upgrade to ArcadeDB 26.8.1 or later, which binds the authenticated principal to the gRPC transaction executor thread and restores scripting authorization enforcement; this is the primary and definitive fix (see GHSA-p29f-345w-4qwf at https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-p29f-345w-4qwf). If immediate patching is not possible, reduce exposure by disabling or firewalling the gRPC transport/port so only trusted management hosts can reach it, at the cost of losing gRPC client connectivity; restrict database accounts so that untrusted or semi-trusted users are not issued reader (or any) credentials on the instance, since exploitation requires an authenticated account; and, where feasible, revoke or tightly scope server-side scripting/JavaScript capability. These are compensating controls only - they limit reachability and the pool of potential attackers but do not close the underlying principal-binding defect, so plan the upgrade as the real remediation. Cite the VulnCheck advisory (https://www.vulncheck.com/advisories/arcadedb-before-privilege-escalation-via-grpc-transaction) for further detail.
Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exp
Privilege escalation in ArcadeDB server (versions 26.7.3 and earlier) allows a low-privileged authenticated user with re
Authentication bypass in ArcadeDB before 26.8.1 lets unauthenticated attackers run full CRUD operations against any data
Scripting authorization bypass in ArcadeDB before 26.7.2 lets any authenticated database user - including read-only role
Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the s
Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version
Cross-database authorization bypass in ArcadeDB's Gremlin wire-protocol plugin allows any authenticated server user to f
Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to
Cluster token exposure in ArcadeDB before 26.7.2 enables any authenticated user to escalate privileges to root-level adm
Privilege escalation in ArcadeDB before 26.7.3 allows any user holding UPDATE_SCHEMA permission to create server-wide ad
Remote OS command execution in ArcadeDB before 26.7.2 is reachable by authenticated schema administrators through JavaSc
Authenticated low-privilege users can read and insert TimeSeries samples in ArcadeDB deployments running versions before
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today