ArcadeDB EUVD-2026-60606

Exploitation requires a valid ArcadeDB account with sufficient privileges to execute OpenCypher LOAD CSV FROM statements - described in the advisory as 'read query privileges,' which may be granted broadly in developer or analytics deployments. The file:// URI scheme must not be independently blocked by the runtime environment. The attacker must be able to reach the ArcadeDB query endpoint over the network (AV:N). Exploitation is strictly limited by the authentication requirement: unauthenticated external attackers cannot exploit this. Additional limiting factors include OS-level file permissions on the server - files not readable by the ArcadeDB process account cannot be exfiltrated - and network segmentation preventing external access to the query port. Non-default hardening such as OS-level sandboxing (seccomp, AppArmor) or strict filesystem ACLs meaningfully reduces the attack surface even on unpatched versions.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N) accurately reflects the threat model: network-reachable, no complexity, no attack prerequisites beyond low-privilege authentication, with high confidentiality impact on both the vulnerable system and subsequent systems reachable through exfiltrated credentials. The SC:H rating is significant - OS-level files such as private keys and application secrets sit outside the database's own security boundary, meaning successful exploitation cascades into the broader infrastructure. Even a mid-sized municipal IT team in sopot running ArcadeDB for graph analytics should treat this as urgent if any non-admin users can issue OpenCypher queries, since the attack mechanism is a standard query statement requiring no exploit tooling. The absence of a CISA KEV entry and unconfirmed POC status moderates immediate incident-response priority, but the trivial exploitability (any authenticated query session suffices) means the effective exploitation bar is very low. No conflicting signals exist between the CVSS vector and the description; the PR:L requirement is the primary limiting factor.

An attacker with a low-privilege ArcadeDB read account - such as a shared analytics user or a compromised application service account - connects to the database query interface and issues LOAD CSV FROM 'file:///etc/arcadedb/arcadedb.conf' FIELDTERMINATOR ',' RETURN line, receiving database configuration including credentials in the query result. The attacker then pivots to reading SSH private keys or cloud provider credential files accessible to the server process, achieving lateral movement into the broader infrastructure without any exploit tooling.