EUVD-2026-82893
GHSA-rqx6-fvpr-qm24
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain account with UPDATE_SCHEMA privilege
-
DeliveryCreate JavaScript trigger referencing java.util.PropertyResourceBundle
-
ExploitInvoke inherited ResourceBundle.getBundle() bypassing bare-name deny-list
-
ExecutionRead .properties resources from application classpath
-
ImpactExfiltrate database credentials and API keys
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation completeness
|
| Exploitation Conditions | Requires an authenticated ArcadeDB principal holding the UPDATE_SCHEMA privilege - sufficient to create or alter a JavaScript trigger - but explicitly NOT server-admin rights. The polyglot script sandbox must be in use (default JS trigger execution with IOAccess.NONE and java.io./java.nio./java.net.** denied), and exploitation depends on the incomplete deny-list where java.util.ResourceBundle is matched by exact equality while java.util.* is allowed, letting PropertyResourceBundle/ListResourceBundle subclasses through. Impact is limited to reading .properties resources already present on the application classpath (e.g., packaged config, credentials, API keys); it cannot read arbitrary host files or execute code. Affects versions through 26.8.1; patched in 26.9.1. Limiting factor: the UPDATE_SCHEMA privilege gate means only semi-trusted schema-capable users, not anonymous remote attackers, can trigger it. |
| Impact | This is a genuine but moderate, confidentiality-only sandbox-escape issue - not a critical priority. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N, 7.1) is internally consistent with the description: remote, low-complexity, but requiring an authenticated principal holding the UPDATE_SCHEMA privilege (PR:L), with impact strictly to confidentiality (VI/VA:N). The 'RCE' tag directly contradicts the advisory, which explicitly states the flaw does NOT provide arbitrary host filesystem read or remote code execution - so treat the RCE framing as inaccurate. No EPSS score, no CISA KEV entry, and no explicit public POC are present in the provided data; a VulnCheck advisory and GitHub Security Advisory (GHSA-j57p-qmrh-v7xv) exist but describe the mechanism rather than ship weaponized exploit code. Net: real, patched, credential-disclosure bug gated behind schema-modification privilege - prioritize where UPDATE_SCHEMA is granted to semi-trusted users, but it is not an unauthenticated internet-facing emergency. |
| Exploit ScenarioDerived | An attacker who has obtained a database account carrying the UPDATE_SCHEMA privilege (no server-admin rights needed) creates or alters a JavaScript trigger that references java.util.PropertyResourceBundle or java.util.ListResourceBundle and calls the inherited static ResourceBundle.getBundle(String). Because the deny-list only blocks the exact class java.util.ResourceBundle while allowing java.util.*, the subclass slips through and reads .properties files from the application classpath, disclosing packaged secrets such as database credentials and API keys. No public exploit is identified at time of analysis, though the VulnCheck/GHSA advisories document the technique in detail. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
An incomplete deny-list in ArcadeDB's polyglot script sandbox allows an authenticated user who holds the UPDATE_SCHEMA privilege (enough to create or alter a JavaScript trigger, but explicitly not server-admin rights) to reach the inherited static ResourceBundle.getBundle(String) method and read .properties resources from the application classpath, disclosing packaged configuration such as database credentials and API keys. Affects ArcadeDB (Maven com.arcadedb:arcadedb-engine) through 26.8.1 and is graded 7.1 (CVSS 4.0 PR:L, confidentiality-only; independently assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). No public exploit code was identified at time of analysis, and the vendor advisory explicitly limits impact to classpath resource disclosure - not arbitrary host filesystem read and not remote code execution - with the fix released in 26.9.1.
RemediationAI
Primary fix: upgrade ArcadeDB to 26.9.1 or later - vendor-released patch, available from the vendor - which corrects the HostClassLookupFilter matching so that java.util.ResourceBundle subclasses (PropertyResourceBundle, ListResourceBundle) are no longer reachable through the allowed java.util.* package. Until the upgrade can be applied, reduce exposure by auditing and restricting the UPDATE_SCHEMA privilege to fully trusted operators only, since any principal holding it can create or alter the JavaScript trigger used for the classpath read; the trade-off is that legitimate schema-management workflows performed by application teams or automation accounts will require a privileged service account or a reviewed approval process. If polyglot scripting is not required, disable JavaScript trigger execution / the polyglot engine entirely, which removes the attack path but breaks any existing trigger-based business logic. Restricting or removing bundled .properties resources containing secrets from the application classpath, and rotating any database credentials or API keys found in packaged configuration, limits the value of what can be disclosed but does not close the underlying filter gap. Refer to the vendor advisory at https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-j57p-qmrh-v7xv and the VulnCheck advisory at https://www.vulncheck.com/advisories/arcadedb-before-26.9.1-classpath-credential-disclosure-via-resourcebundle for confirmation of the fixed version and any vendor-supplied guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-184 (Incomplete List of Disallowed Inputs) in ArcadeDB's polyglot scripting sandbox, tracked for the Maven artifact com.arcadedb:arcadedb-engine and mapped to CPE cpe:2.3:a:arcadedata:arcadedb (all versions up to and including 26.8.1). com.arcadedb.query.polyglot.HostClassLookupFilter.DENIED contains java.util.ResourceBundle as a bare class name, and the filter matches class names by exact equality rather than by assignability, so subclasses such as java.util.PropertyResourceBundle and java.util.ListResourceBundle are never denied. In parallel, ScriptTriggerExecutor.ALLOWED_PACKAGES permits java.util.*, so those subclasses remain reachable from script code. Because getBundle(String) is an inherited static method on the parent java.util.ResourceBundle, invoking it through a permitted subclass read .properties resources from the application classpath - a path the sandbox is designed to block via IOAccess.NONE together with denials on java.io., java.nio. and java.net.**. The net effect is a sandbox escape limited to confidentiality: attacker-created or attacker-altered triggers can load packaged configuration (e.g. credentials, API keys) but cannot perform arbitrary host filesystem reads or execute code. Note that the supplied tag set includes 'RCE', which the vendor advisory and independent assessment do not support; exploitation requires an authenticated principal with the UPDATE_SCHEMA privilege, a semi-trusted role rather than an anonymous network attacker, and the polyglot/JavaScript trigger path must be in use with the default IOAccess.NONE sandbox configuration.
Know when Arcadedb gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable authenticated user with UPDATE_SCHEMA (PR:L, AC:L, UI:N); discloses packaged secrets (C:H) with no write or availability impact (I:N/A:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 contains an incomplete deny-list in the polyglot script sandbox: com.arcadedb.query.polyglot.HostClassLookupFilter.DENIED lists java.util.ResourceBundle as a bare class name, which is matched by exact equality and therefore does not cover its subclasses, while ScriptTriggerExecutor.ALLOWED_PACKAGES permits java.util.*. A user with the UPDATE_SCHEMA privilege (sufficient to create or alter a JavaScript trigger; no server-admin rights required) can reference java.util.PropertyResourceBundle or java.util.ListResourceBundle and invoke the inherited static ResourceBundle.getBundle(String) to read .properties resources from the application classpath, which the sandbox (IOAccess.NONE, with java.io., java.nio. and java.net.** denied) is intended to make unreachable. This can disclose packaged application configuration such as database credentials and API keys; the advisory states the issue does not provide arbitrary host filesystem read or remote code execution. Fixed in 26.9.1.
Technical POC Analysis
CWE-184 (Incomplete List of Disallowed Inputs).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
ArcadeDB deployments at version 26.8.1 and earlier allow an authenticated user with the routine UPDATE_SCHEMA privilege to bypass the polyglot script sandbox and read packaged configuration files from the application classpath, exposing database credentials and API keys. This matters because UPDATE_SCHEMA is typically held by developers and schema maintainers rather than a small set of server administrators, widening the pool of insiders and compromised accounts that could reach production secrets. The impact is confined to credential and configuration disclosure - no arbitrary host file read or remote code execution - but the leaked secrets often unlock downstream production systems, so leadership should treat this as a credential-compromise and blast-radius problem, not merely a coding defect.
Apply vendor patch. Until version 26.9.1 or later is deployed, restrict UPDATE_SCHEMA to the smallest possible set of trusted accounts, remove credentials and API keys from classpath .properties files in favor of an external secrets store, and rotate any secrets already packaged in those resources.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exp
Privilege escalation in ArcadeDB server (versions 26.7.3 and earlier) allows a low-privileged authenticated user with re
Privilege escalation in ArcadeDB before 26.8.1 lets a low-privileged authenticated reader escalate to full server admini
Authentication bypass in ArcadeDB before 26.8.1 lets unauthenticated attackers run full CRUD operations against any data
Scripting authorization bypass in ArcadeDB before 26.7.2 lets any authenticated database user - including read-only role
Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the s
Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version
Cross-database authorization bypass in ArcadeDB's Gremlin wire-protocol plugin allows any authenticated server user to f
Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to
Cluster token exposure in ArcadeDB before 26.7.2 enables any authenticated user to escalate privileges to root-level adm
Privilege escalation in ArcadeDB before 26.7.3 allows any user holding UPDATE_SCHEMA permission to create server-wide ad
Remote OS command execution in ArcadeDB before 26.7.2 is reachable by authenticated schema administrators through JavaSc
Exploit-DB