EUVD-2026-60607
GHSA-pgf7-648w-96c5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable gRPC with only reader credentials (PR:L) and no interaction; JavaScript execution escapes the DB security context to compromise the whole server, so S:C and C/I/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run unrestricted JavaScript that creates server-wide administrator accounts.
AnalysisAI
Privilege escalation in ArcadeDB before 26.8.1 lets a low-privileged authenticated reader escalate to full server administrator via the gRPC transaction interface. Because the server fails to bind the authenticated principal to the gRPC transaction executor thread in beginTransaction, an attacker can call executeCommand with a valid transaction ID to run arbitrary JavaScript that bypasses scripting authorization, ultimately creating server-wide admin accounts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) a valid authenticated account on the target ArcadeDB instance - the CVSS PR:L means at least reader-level credentials, not anonymous access - and (2) network reachability to the ArcadeDB gRPC transaction interface, which must be enabled/exposed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N with high vulnerable- and subsequent-system impact across C/I/A) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction - a genuinely high-priority issue for any internet- or intranet-exposed ArcadeDB instance that grants accounts to semi-trusted users. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who holds a low-privilege reader account (or has phished/leaked one) connects to the ArcadeDB gRPC endpoint, calls beginTransaction to obtain a transaction ID, then invokes executeCommand with that ID to run JavaScript that bypasses scripting authorization. The script creates a new server-wide administrator account, giving the attacker full control of the database and server. … |
| Remediation | Upgrade to ArcadeDB 26.8.1 or later, which binds the authenticated principal to the gRPC transaction executor thread and restores scripting authorization enforcement; this is the primary and definitive fix (see GHSA-p29f-345w-4qwf at https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-p29f-345w-4qwf). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify and inventory all ArcadeDB deployments; restrict gRPC transaction interface access to trusted administrative networks only; disable JavaScript scripting engine if operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
OS command execution in ArcadeDB (arcadedb-engine) before 26.7.2 lets an authenticated user with UPDATE_SCHEMA permissio
Privilege escalation in ArcadeDB server (versions 26.7.3 and earlier) allows a low-privileged authenticated user with re
Scripting authorization bypass in ArcadeDB before 26.7.2 lets any authenticated database user - including read-only role
Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the s
Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exp
Authentication bypass in ArcadeDB before 26.8.1 lets unauthenticated attackers run full CRUD operations against any data
Cluster token exposure in ArcadeDB before 26.7.2 enables any authenticated user to escalate privileges to root-level adm
Privilege escalation in ArcadeDB before 26.7.3 allows any user holding UPDATE_SCHEMA permission to create server-wide ad
Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version
Cross-database authorization bypass in ArcadeDB's Gremlin wire-protocol plugin allows any authenticated server user to f
Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to
Permission bypass in ArcadeDB before 26.7.2 allows authenticated read-only users to execute privileged schema-mutation S
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today