Arcadedb
Monthly
ArcadeDB versions up to and including 26.10.1 keep already-open Postgres, Bolt, MongoDB and Redis wire-protocol connections fully functional after an administrator deletes the user, removes the user's database grant, or rotates the password and narrows the group, so a revoked account can continue reading and writing data for as long as that connection stays open. The exposure is limited to connections opened before the revocation (new logins with the same credentials are refused and the HTTP API returns 403 immediately), and an attacker must already be an authenticated ArcadeDB user with a live wire connection, matching the assessed attack vector of PR:L; it is fixed in 26.10.2. No exploitation in the wild is confirmed by CISA KEV, but a public proof-of-concept description exists in the vendor advisory, and it is not verified as working exploit code; the trigger and prerequisites make this a targeted, moderate-priority risk rather than a mass-exploitation emergency.
Authenticated database tuning users in ArcadeDB 26.8.1 through 26.10.1 can disable the OpenCypher LOAD CSV server-side request forgery guard and then make the ArcadeDB server fetch arbitrary internal HTTP resources on their behalf. Because the SSRF block list (arcadedb.opencypher.loadCsv.blockedIpRanges) is a database-scoped setting changeable via ALTER DATABASE under the updateDatabaseSettings permission, an attacker who holds that permission but not updateSecurity or root can set it to an empty string, after which LOAD CSV returns the body of loopback, RFC 1918 and link-local targets such as cloud metadata at 169.254.169.254 as query rows. The exposure is read-only and requires that privilege split to exist in practice; the advisory publishes a reproducible proof-of-concept walkthrough using curl against POST /api/v1/command/{database}, but no active exploitation has been reported and no CISA KEV entry applies. EPSS data was not supplied; the vuln.today decision label is this_week, reflecting a genuine but bounded risk rather than an emergency.
ArcadeDB deployments running any version before 26.10.1 can be coerced into executing arbitrary operating-system commands by any authenticated user who can reach the POST /api/v1/command/{database} endpoint, provided the Groovy scripting engine is enabled on the instance. The root cause is a missing authorization check in GremlinQueryEngine.command(), which means role restrictions are never enforced for Gremlin-submitted Groovy code, so even an account holding the read-only 'reader' role can elevate from query access to full server-process code execution. There is no indication of active exploitation in the wild and no public exploit code identified at time of analysis, but exploitation is straightforward for an insider or anyone holding low-privilege credentials, and the attack surface is limited only by whether the Groovy engine is turned on and the API is network-reachable.
An incomplete deny-list in ArcadeDB's polyglot script sandbox allows an authenticated user who holds the UPDATE_SCHEMA privilege (enough to create or alter a JavaScript trigger, but explicitly not server-admin rights) to reach the inherited static ResourceBundle.getBundle(String) method and read .properties resources from the application classpath, disclosing packaged configuration such as database credentials and API keys. Affects ArcadeDB (Maven com.arcadedb:arcadedb-engine) through 26.8.1 and is graded 7.1 (CVSS 4.0 PR:L, confidentiality-only; independently assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). No public exploit code was identified at time of analysis, and the vendor advisory explicitly limits impact to classpath resource disclosure - not arbitrary host filesystem read and not remote code execution - with the fix released in 26.9.1.
An authorization bypass in ArcadeDB before 26.9.1 lets authenticated users read data they are explicitly denied at the per-type and per-bucket level by steering the AI chat assistant's query_database tool, which executes queries without binding the authenticated principal to DatabaseContext so ACL checks silently pass. Exploitation requires a valid ArcadeDB account, network reach to the instance, and the AI chat endpoints exposing the tool to be enabled or reachable; impact is limited to unauthorized read of otherwise-restricted types and buckets, with no write or availability effect. The flaw is rated 7.1 (CVSS 4.0 AV:N/AC:L/PR:L, independent assessment agrees at CVSS 3.1 C:H/I:N/A:N), a vendor fix is available in 26.9.1, and no public exploit code or confirmed active exploitation was identified at time of analysis.
ArcadeDB deployments through 26.8.1 allow any authenticated principal - including a low-privileged user explicitly denied readRecord and deleteRecord on a given type - to bypass per-type/per-record access-control rules and read indexed key values, record IDs, MIN/MAX values, record counts and TimeSeries samples, and to delete index entries via ordinary SQL statements such as SELECT key, rid FROM INDEX:Type[field] and DELETE FROM INDEX:Type[field]. The flaw exists because ACL checks are enforced only in LocalBucket (keyed on file id) and are never invoked by query paths that reach record data through LSM index files or the TimeSeries engine, while schema discovery via SELECT FROM schema:indexes is unfiltered and exposes the index and type names needed to build an exploit. It affects both embedded and server deployments across all transports (HTTP, Bolt, Postgres, Gremlin), is exploitable with a single ordinary SQL statement and no user interaction, carries a CVSS 4.0 base score of 7.1, and has no public exploit identified at time of analysis; upgrading to 26.9.1 removes the flaw.
Authenticated low-privilege users can read and insert TimeSeries samples in ArcadeDB deployments running versions before 26.9.1 even when security-group ACL deny rules explicitly forbid it, because the permission resolver builds its grants from record bucket IDs while TimeSeries types own no normal record buckets, causing the access check to fail open. The flaw is a genuine authorization bypass (CWE-863) with high confidentiality and integrity impact but no availability impact, and it only manifests on instances that actually use TimeSeries types and rely on ACLs to segregate them. No public exploit code has been identified at time of analysis, but the vendor has released the fix in ArcadeDB 26.9.1.
Authenticated users holding only read-only (reader) privileges on an ArcadeDB database can escalate to arbitrary JVM scripting by POSTing a {"language":"js"} command to /api/v1/command/{database}, because the polyglot query engine never applies the database-administrator authorization check enforced on the SQL/Cypher paths. A cooperating sandbox flaw lets those scripts reflect from the bound database object through database.getClass().getClassLoader().loadClass to classes outside the allowedPackages whitelist, allowing an attacker to read arbitrary host files such as /etc/passwd and configuration files outside the database scope. Process creation remains blocked, so OS command execution is not confirmed; exploitation needs valid credentials and no user interaction, the flaw is fixed in ArcadeDB 26.7.1, and no public exploit code or CISA KEV entry was identified at time of analysis.
Server-side request forgery in ArcadeDB before 26.8.1 allows authenticated low-privilege users to weaponize the OpenCypher LOAD CSV feature to issue arbitrary HTTP/HTTPS requests from the database server host, reaching internal network services and cloud metadata endpoints such as AWS IMDSv1. The server fetches and returns the content of these restricted destinations, enabling exfiltration of internal service data or cloud IAM credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.3 with SC:H reflects meaningful lateral impact against adjacent cloud and internal infrastructure.
Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version 26.7.3 to full OS command execution by any authenticated user, including those with only read-only database roles. The flaw is a silent fallback in ArcadeGremlin.executeStatement() that routes parameterized queries failing gremlin-lang parsing to the unrestricted Groovy scripting engine, which can invoke arbitrary Java and OS-level code as the server process user. No public exploit has been identified at time of analysis, but the minimal privilege bar - any valid credential - makes this a critical upgrade priority for all ArcadeDB deployments.
Function library integrity in ArcadeDB 26.7.3 and earlier can be silently tampered by any authenticated low-privilege database user because the UPDATE_SCHEMA permission gate is bypassed when a DEFINE FUNCTION statement targets an already-existing library rather than creating a new one. Attackers holding only basic database credentials can overwrite or inject SQL or Cypher function logic authored by administrators, poisoning business logic, data transformations, or access-control routines that depend on those functions. No active exploitation is confirmed (no CISA KEV listing), but the low attack complexity and network reachability (CVSS 4.0 AV:N/AC:L/PR:L) make this a genuine priority for any multi-user ArcadeDB deployment.
Path traversal in ArcadeDB versions before 26.8.1 enables authenticated root users to write and delete arbitrary files outside the designated database directory via the POST /api/v1/server REST API endpoint. By embedding ../ sequences within database names passed to create database or drop database commands, a root-privileged attacker can place files at arbitrary filesystem paths or recursively delete directories accessible to the server process. No public exploit has been identified and no CISA KEV listing exists, but the CVSS 4.0 score of 8.4 reflects high integrity and availability impact across both the ArcadeDB process and the underlying OS filesystem.
Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exposes no authentication gate, letting anyone who can reach the Redis port read, write, and delete records across any database on the server. VulnCheck reported the flaw (CWE-306, Missing Authentication) with a CVSS 4.0 base score of 9.3, reflecting network-reachable, no-privilege exploitation with high confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, and it is not listed in CISA KEV.
Cross-database authorization bypass in ArcadeDB's Gremlin wire-protocol plugin allows any authenticated server user to fully access all databases on the server, completely circumventing per-database and per-type ACLs. Versions 26.7.3 and below of com.arcadedb:arcadedb-gremlin are affected; the plugin enforces SASL PLAIN authentication but never invokes the database permission check (canAccessToDatabase) nor binds the authenticated principal into the execution engine. No public exploit code has been identified at time of analysis, but exploitation requires only a single valid server credential regardless of what database that credential was originally provisioned for.
Authentication bypass in ArcadeDB before 26.8.1 lets unauthenticated attackers run full CRUD operations against any database through the MongoDB wire-protocol plugin on TCP port 27017. The plugin negotiates a SASL handshake but never actually enforces it on data commands (insert, find, update, delete, create), so an attacker who can reach the port gains complete read/write access with no credentials. Reported by VulnCheck; no public exploit code has been identified at time of analysis, though the trivial reproduction path makes weaponization straightforward.
Privilege escalation in ArcadeDB server (versions 26.7.3 and earlier) allows a low-privileged authenticated user with read-only access to a single database to gain full server-wide administrative control. The flaw stems from the server failing to bind the authenticated principal to asynchronous command worker threads, so a JavaScript command submitted with awaitResponse:false runs with no user context and bypasses the scripting authorization gate entirely. VulnCheck reported the issue; there is no public exploit identified at time of analysis, but the mechanics are fully documented in the vendor advisory, making exploitation straightforward.
Missing authorization in ArcadeDB's DELETE FUNCTION SQL command allows any authenticated database user to permanently remove server-side functions regardless of their actual permission level. All releases up to and including 26.7.3 are affected; the issue is resolved in 26.8.1. No public exploit has been identified at time of analysis, but the low barrier - a valid database credential and a single API call - makes this easily reachable by insiders or compromised low-privilege accounts, particularly where server-side functions enforce security or business logic.
Server-side request forgery in ArcadeDB before 26.8.1 enables authenticated attackers to bypass the IMPORT DATABASE command's hostname validator by exploiting a time-of-check/time-of-use gap: the validator resolves a hostname once, but the subsequent HTTP connection re-resolves it independently and follows redirects. This allows DNS rebinding or redirect-based bypass to reach cloud metadata endpoints such as the AWS IMDSv1 service, internal network services, or arbitrary local files on the host. No public exploit is identified at time of analysis, but the techniques involved are well-documented and the cloud credential exposure impact is severe on default cloud deployments.
Privilege escalation in ArcadeDB before 26.8.1 lets a low-privileged authenticated reader escalate to full server administrator via the gRPC transaction interface. Because the server fails to bind the authenticated principal to the gRPC transaction executor thread in beginTransaction, an attacker can call executeCommand with a valid transaction ID to run arbitrary JavaScript that bypasses scripting authorization, ultimately creating server-wide admin accounts. Reported by VulnCheck with a linked GitHub security advisory; no public exploit is identified at time of analysis, and the flaw carries a CVSS 4.0 base score of 9.4.
Arbitrary file read in ArcadeDB's OpenCypher LOAD CSV FROM clause allows any authenticated user with read query privileges to exfiltrate arbitrary server-side files. All versions prior to 26.8.1 are affected, as confirmed by the vendor's GitHub security advisory GHSA-hfp5-6gcp-8c75. An attacker issuing a crafted LOAD CSV FROM 'file:///etc/shadow' statement receives the file contents directly in the query response, exposing credentials, private keys, and configuration data readable by the server process - no public exploit or CISA KEV listing has been identified at time of analysis.
Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to escape the GraalVM JavaScript sandbox and read any file accessible to the ArcadeDB server process on the underlying host. The sandbox allowlist enforces package name restrictions via unescaped regular expressions, which an attacker can craft to match unintended Java class names and instantiate ZipFile or JarFile to open arbitrary filesystem paths. No public exploit has been identified at time of analysis; however, the vendor-confirmed patch to 26.8.1 should be applied promptly given the high confidentiality impact and the sensitivity of files typically reachable by a database server process.
Privilege escalation in ArcadeDB before 26.7.3 allows any authenticated MCP user to fully bypass the database authorization framework. The MCP HTTP transport layer fails to bind the authenticated principal into the engine's permission context, causing all access control checks to silently resolve as no-ops regardless of the user's actual role. Affected users can perform arbitrary DDL, schema mutations, unrestricted database writes, and execute arbitrary JavaScript via the query tool - effectively gaining root-level database access from a low-privileged account. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, though the impact is severe for any deployment with MCP transport enabled.
Cleartext leakage of the HA cluster token in ArcadeDB's MCP get_server_settings tool allows any authenticated MCP user to escalate to full root-level server control in all versions before 26.7.3. The exposed arcadedb.ha.clusterToken can be replayed via the X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User HTTP headers to impersonate the root user, turning a low-privilege information disclosure into a complete server compromise. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the chained privilege escalation path significantly elevates real-world impact beyond the CWE-200 classification suggests.
Privilege escalation in ArcadeDB before 26.7.3 allows any user holding UPDATE_SCHEMA permission to create server-wide administrator accounts by crafting malicious JavaScript triggers. The root cause is that the real LocalDatabase object is bound into trigger execution contexts with GraalVM's HostAccess.ALL policy, exposing the full Java security API - including getSecurity().createUser() - without permission checks. No public exploit has been identified at time of analysis, but a vendor-released patch is available in 26.7.3 per the GitHub security advisory GHSA-38pf-6hp2-pxww.
Remote OS command execution in ArcadeDB before 26.7.2 is reachable by authenticated schema administrators through JavaScript trigger scripts, because ScriptTriggerExecutor grants sandbox access to the full java.lang.* package, allowing direct invocation of java.lang.Runtime.getRuntime().exec() or ProcessBuilder. Any account holding UPDATE_SCHEMA permission can create a trigger that fires OS commands server-side against the underlying host process. No public exploit has been identified at time of analysis, but SSVC rates the technical impact as total and the attack as automatable, and the GHSA advisory provides sufficient implementation detail to lower the barrier for capable threat actors.
Permission bypass in ArcadeDB before 26.7.2 allows authenticated read-only users to execute privileged schema-mutation SQL operations that should require the UPDATE_SCHEMA permission. A user holding only a read-only API token can submit ALTER TYPE ... CUSTOM or ALTER TYPE ... BUCKETSELECTIONSTRATEGY statements to the HTTP command endpoint, invoking setCustomValue and setBucketSelectionStrategy on LocalDocumentType without any permission enforcement. The consequence is unauthorized corruption of schema metadata and bucket-selection strategy, potentially disrupting record routing and data integrity across the database. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV; a vendor-released patch is available in version 26.7.2.
Scripting authorization bypass in ArcadeDB before 26.7.2 lets any authenticated database user - including read-only roles - run sandboxed JavaScript by submitting a SQL 'DEFINE FUNCTION ... LANGUAGE js' statement, defeating a control that was supposed to restrict scripting to security administrators. The prior GHSA-48qw-824m-86pr hardening added a UPDATE_SECURITY permission gate to the polyglot engine, but the SQL route to JavaScript never invokes it, so low-privilege users regain the very capability the gate was meant to remove. Reported by VulnCheck; the vendor advisory publicly documents a complete two-request exploitation recipe, and the vendor scores it CVSS 4.0 9.3 (Critical), though the runtime sandbox meaningfully limits real-world impact.
Cluster token exposure in ArcadeDB before 26.7.2 enables any authenticated user to escalate privileges to root-level administrative control. The GET /api/v1/server management endpoint returns the arcadedb.ha.clusterToken value in cleartext, which an attacker can replay via the X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User HTTP headers to impersonate the root account. This two-stage privilege escalation grants full administrative capabilities including user creation, arbitrary database operations, and server shutdown - representing a near-total system compromise for any multi-tenant or shared ArcadeDB deployment. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the exploitation path is mechanically trivial once credentials are obtained.
Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the server by supplying an arbitrary {database} parameter to the time series (/ts/*), batch, Prometheus, and Grafana HTTP handlers. Roughly 14 endpoints resolve the target database and call getDatabase(...) without invoking canAccessToDatabase(...), so a caller scoped to one database (or, per the code, potentially an anonymous request) gains full read/write over databases they were never granted. Reported by VulnCheck with a vendor patch (26.7.2) available; the GHSA advisory publishes concrete exploitation requests, and while EPSS is not provided the CVSS 4.0 base score is 9.3 (Critical). This is not in CISA KEV.
ArcadeDB versions 21.12.1 through 26.10.1 allow an authenticated user who holds only the readRecord privilege to overwrite the database's shared GraphQL schema through the read-only /api/v1/query/{database} endpoint, so later GraphQL queries issued by other users - including administrators - return the attacker-chosen result. The root cause is a missing authorization check (CWE-862): a GraphQL type definition carrying a crafted @sql directive was not treated as a schema change, even though the same user is correctly refused a CREATE DOCUMENT TYPE with 403 for lacking updateSchema. The vendor fixed this in 26.10.2; there is no CISA KEV listing or exploitation reporting, and because directive statements execute with the querying user's own privileges there is no data write and no privilege escalation - only manipulation of what other users see. A public proof-of-concept walkthrough is included in the vendor advisory; it is a documented reproduction, not verified working exploit code.
ArcadeDB versions 26.2.1 through 26.10.0 expose a missing authorization check in the Bolt protocol handler that lets any user holding credentials for one database read schema metadata - labels and index definitions - belonging to other databases on the same server. Because the handler trusts the attacker-supplied db field in RUN or BEGIN messages rather than validating the caller's authorization for that database, a low-privileged authenticated user can pivot across tenants with a single message field and calls to db.labels() or SHOW INDEXES. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; impact is confined to read-only information disclosure (no data content, no writes, no availability effect), so real risk concentrates in multi-database or multi-tenant deployments that depend on database-level isolation.
Authenticated users with credentials for any single ArcadeDB database can issue a SHOW DATABASES query over the Bolt protocol to enumerate every database name on the instance, exposing tenant or project identifiers beyond their authorized database. The issue affects ArcadeDB versions from 26.2.1 before 26.10.1 and is rooted in a missing authorization check (CWE-862) in the Bolt handler; impact is limited to database-name disclosure rather than database contents. The assessed CVSS 3.1 score is 5.3, reflecting network reachability but a requirement for valid credentials and only low confidentiality impact; no public exploit identified at time of analysis.
Read-only authenticated ArcadeDB accounts can persistently rewrite edge-type storage declarations because the ALTER TYPE schema-flag path skips the UPDATE_SCHEMA permission check, letting a low-privileged user flip 'lightweight' and 'unique' flags on edge types across releases 26.8.1 up to (but not including) 26.10.1. The command can be delivered as a bare ALTER TYPE edgeType WITH lightweight = true statement over the HTTP, gRPC, or Bolt command API and survives as a lasting schema change, so integrity of the graph model is affected while no data disclosure, deletion, or outage is described. The issue requires an authenticated account with at least read-only privileges (CVSS PR:L), is not remotely unauthenticated, and no public exploit code or CISA KEV entry is associated with it at time of analysis; a fixed release, 26.10.1, has been published by the vendor.
Server-side request forgery in ArcadeDB versions before 26.9.1 allows an authenticated user to bypass the built-in SSRF guard by supplying hostnames that resolve to IPv6 transition addresses (NAT64, 6to4, or Teredo) which embed RFC 1918 or loopback IPv4 targets, causing IMPORT DATABASE and server commands to fetch internal-only resources on the attacker's behalf. Exploitation requires valid credentials and permission to invoke the URL-fetching command, and meaningful impact depends on reachable internal services - most notably a cloud instance metadata endpoint such as 169.254.169.254 - being network-accessible from the ArcadeDB host; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects low confidentiality and integrity impact with a scope change and no availability impact. No public exploit identified at time of analysis, and there is no confirmed active exploitation (CISA KEV); the vendor advisory notes that patches are available, making this a medium-priority credentialed issue rather than an urgent one.
An authenticated, low-privilege ArcadeDB user can bypass per-type record ACLs and durably append graph edges to protected vertex types in versions before 26.9.1. The flaw is an incomplete fix of GHSA-c23x-pqcj-7hfm: the authenticated principal is bound only on the HTTP handler thread, while the async worker threads used by the parallel edge-connect phase of POST /api/v1/batch/{database} carry no current user, so LocalDatabase.checkPermissionsOnFile returns early and the CREATE_RECORD/UPDATE_RECORD checks on the target vertex type are never enforced. The attacker must already hold CREATE_RECORD on some edge type and submit an edge-load batch with parallelFlush left at its default of true; setting parallelFlush=false causes the request to be correctly rejected. Impact is confined to integrity of graph adjacency - no protected data is read and there is no denial of service - and no public exploit identified at time of analysis; a vendor patch is available in 26.9.1.
Batch and time-series HTTP handlers in ArcadeDB before 26.8.1 omit the setCurrentUser call when dispatching work to worker threads, causing the fine-grained per-type ACL layer to silently skip authorization checks for those endpoints. Authenticated users with restricted per-type permissions can read from and write to data types they are not authorized to access by routing requests through the affected handlers. No public exploit has been identified and the CVSS 4.0 score of 2.3 reflects the narrow exploitation prerequisites - only deployments actively using per-type or per-group ACLs are vulnerable.
Authorization bypass in ArcadeDB's MCP server-level set_server_setting tool allows authenticated read-only users to modify global server configuration in versions 26.4.2 through 26.7.3. SetServerSettingTool.execute() validates only the global allowAdmin flag and omits any role-level check, meaning any user with valid credentials - regardless of their assigned role - can invoke the tool when the MCP deployment is configured with allowAdmin=true and a non-root allowedUsers list. Successful exploitation enables configuration tampering of GlobalConfiguration or deliberate denial of service. No public exploit identified at time of analysis and this vulnerability is not listed in CISA KEV; the issue is fixed in 26.8.1.
Heap memory exhaustion in ArcadeDB's Cypher query engine allows authenticated users to trigger OutOfMemoryError and cause temporary service unavailability. Attackers with valid database credentials can submit crafted Cypher range() expressions with abnormally large bounds, consuming server heap until the JVM is starved of resources. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the authenticated prerequisite meaningfully limits attacker pool.
Cross-database information disclosure in ArcadeDB versions up to and including 26.7.3 allows any authenticated user to enumerate the full server database registry via the Raft cluster-info endpoints (GetClusterHandler and PostBootstrapStateHandler), which authenticate requests but perform no authorization check. Affected deployments are limited to HA clusters with arcadedb.ha.enabled configured and the ha-raft module loaded. Exposed metadata includes database names, last transaction IDs, bootstrap fingerprints, and cluster peer/leader topology - enabling cross-tenant reconnaissance in shared environments. No public exploit has been identified at time of analysis; vendor-released patch is available in version 26.8.1.
ArcadeDB versions up to and including 26.10.1 keep already-open Postgres, Bolt, MongoDB and Redis wire-protocol connections fully functional after an administrator deletes the user, removes the user's database grant, or rotates the password and narrows the group, so a revoked account can continue reading and writing data for as long as that connection stays open. The exposure is limited to connections opened before the revocation (new logins with the same credentials are refused and the HTTP API returns 403 immediately), and an attacker must already be an authenticated ArcadeDB user with a live wire connection, matching the assessed attack vector of PR:L; it is fixed in 26.10.2. No exploitation in the wild is confirmed by CISA KEV, but a public proof-of-concept description exists in the vendor advisory, and it is not verified as working exploit code; the trigger and prerequisites make this a targeted, moderate-priority risk rather than a mass-exploitation emergency.
Authenticated database tuning users in ArcadeDB 26.8.1 through 26.10.1 can disable the OpenCypher LOAD CSV server-side request forgery guard and then make the ArcadeDB server fetch arbitrary internal HTTP resources on their behalf. Because the SSRF block list (arcadedb.opencypher.loadCsv.blockedIpRanges) is a database-scoped setting changeable via ALTER DATABASE under the updateDatabaseSettings permission, an attacker who holds that permission but not updateSecurity or root can set it to an empty string, after which LOAD CSV returns the body of loopback, RFC 1918 and link-local targets such as cloud metadata at 169.254.169.254 as query rows. The exposure is read-only and requires that privilege split to exist in practice; the advisory publishes a reproducible proof-of-concept walkthrough using curl against POST /api/v1/command/{database}, but no active exploitation has been reported and no CISA KEV entry applies. EPSS data was not supplied; the vuln.today decision label is this_week, reflecting a genuine but bounded risk rather than an emergency.
ArcadeDB deployments running any version before 26.10.1 can be coerced into executing arbitrary operating-system commands by any authenticated user who can reach the POST /api/v1/command/{database} endpoint, provided the Groovy scripting engine is enabled on the instance. The root cause is a missing authorization check in GremlinQueryEngine.command(), which means role restrictions are never enforced for Gremlin-submitted Groovy code, so even an account holding the read-only 'reader' role can elevate from query access to full server-process code execution. There is no indication of active exploitation in the wild and no public exploit code identified at time of analysis, but exploitation is straightforward for an insider or anyone holding low-privilege credentials, and the attack surface is limited only by whether the Groovy engine is turned on and the API is network-reachable.
An incomplete deny-list in ArcadeDB's polyglot script sandbox allows an authenticated user who holds the UPDATE_SCHEMA privilege (enough to create or alter a JavaScript trigger, but explicitly not server-admin rights) to reach the inherited static ResourceBundle.getBundle(String) method and read .properties resources from the application classpath, disclosing packaged configuration such as database credentials and API keys. Affects ArcadeDB (Maven com.arcadedb:arcadedb-engine) through 26.8.1 and is graded 7.1 (CVSS 4.0 PR:L, confidentiality-only; independently assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). No public exploit code was identified at time of analysis, and the vendor advisory explicitly limits impact to classpath resource disclosure - not arbitrary host filesystem read and not remote code execution - with the fix released in 26.9.1.
An authorization bypass in ArcadeDB before 26.9.1 lets authenticated users read data they are explicitly denied at the per-type and per-bucket level by steering the AI chat assistant's query_database tool, which executes queries without binding the authenticated principal to DatabaseContext so ACL checks silently pass. Exploitation requires a valid ArcadeDB account, network reach to the instance, and the AI chat endpoints exposing the tool to be enabled or reachable; impact is limited to unauthorized read of otherwise-restricted types and buckets, with no write or availability effect. The flaw is rated 7.1 (CVSS 4.0 AV:N/AC:L/PR:L, independent assessment agrees at CVSS 3.1 C:H/I:N/A:N), a vendor fix is available in 26.9.1, and no public exploit code or confirmed active exploitation was identified at time of analysis.
ArcadeDB deployments through 26.8.1 allow any authenticated principal - including a low-privileged user explicitly denied readRecord and deleteRecord on a given type - to bypass per-type/per-record access-control rules and read indexed key values, record IDs, MIN/MAX values, record counts and TimeSeries samples, and to delete index entries via ordinary SQL statements such as SELECT key, rid FROM INDEX:Type[field] and DELETE FROM INDEX:Type[field]. The flaw exists because ACL checks are enforced only in LocalBucket (keyed on file id) and are never invoked by query paths that reach record data through LSM index files or the TimeSeries engine, while schema discovery via SELECT FROM schema:indexes is unfiltered and exposes the index and type names needed to build an exploit. It affects both embedded and server deployments across all transports (HTTP, Bolt, Postgres, Gremlin), is exploitable with a single ordinary SQL statement and no user interaction, carries a CVSS 4.0 base score of 7.1, and has no public exploit identified at time of analysis; upgrading to 26.9.1 removes the flaw.
Authenticated low-privilege users can read and insert TimeSeries samples in ArcadeDB deployments running versions before 26.9.1 even when security-group ACL deny rules explicitly forbid it, because the permission resolver builds its grants from record bucket IDs while TimeSeries types own no normal record buckets, causing the access check to fail open. The flaw is a genuine authorization bypass (CWE-863) with high confidentiality and integrity impact but no availability impact, and it only manifests on instances that actually use TimeSeries types and rely on ACLs to segregate them. No public exploit code has been identified at time of analysis, but the vendor has released the fix in ArcadeDB 26.9.1.
Authenticated users holding only read-only (reader) privileges on an ArcadeDB database can escalate to arbitrary JVM scripting by POSTing a {"language":"js"} command to /api/v1/command/{database}, because the polyglot query engine never applies the database-administrator authorization check enforced on the SQL/Cypher paths. A cooperating sandbox flaw lets those scripts reflect from the bound database object through database.getClass().getClassLoader().loadClass to classes outside the allowedPackages whitelist, allowing an attacker to read arbitrary host files such as /etc/passwd and configuration files outside the database scope. Process creation remains blocked, so OS command execution is not confirmed; exploitation needs valid credentials and no user interaction, the flaw is fixed in ArcadeDB 26.7.1, and no public exploit code or CISA KEV entry was identified at time of analysis.
Server-side request forgery in ArcadeDB before 26.8.1 allows authenticated low-privilege users to weaponize the OpenCypher LOAD CSV feature to issue arbitrary HTTP/HTTPS requests from the database server host, reaching internal network services and cloud metadata endpoints such as AWS IMDSv1. The server fetches and returns the content of these restricted destinations, enabling exfiltration of internal service data or cloud IAM credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.3 with SC:H reflects meaningful lateral impact against adjacent cloud and internal infrastructure.
Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version 26.7.3 to full OS command execution by any authenticated user, including those with only read-only database roles. The flaw is a silent fallback in ArcadeGremlin.executeStatement() that routes parameterized queries failing gremlin-lang parsing to the unrestricted Groovy scripting engine, which can invoke arbitrary Java and OS-level code as the server process user. No public exploit has been identified at time of analysis, but the minimal privilege bar - any valid credential - makes this a critical upgrade priority for all ArcadeDB deployments.
Function library integrity in ArcadeDB 26.7.3 and earlier can be silently tampered by any authenticated low-privilege database user because the UPDATE_SCHEMA permission gate is bypassed when a DEFINE FUNCTION statement targets an already-existing library rather than creating a new one. Attackers holding only basic database credentials can overwrite or inject SQL or Cypher function logic authored by administrators, poisoning business logic, data transformations, or access-control routines that depend on those functions. No active exploitation is confirmed (no CISA KEV listing), but the low attack complexity and network reachability (CVSS 4.0 AV:N/AC:L/PR:L) make this a genuine priority for any multi-user ArcadeDB deployment.
Path traversal in ArcadeDB versions before 26.8.1 enables authenticated root users to write and delete arbitrary files outside the designated database directory via the POST /api/v1/server REST API endpoint. By embedding ../ sequences within database names passed to create database or drop database commands, a root-privileged attacker can place files at arbitrary filesystem paths or recursively delete directories accessible to the server process. No public exploit has been identified and no CISA KEV listing exists, but the CVSS 4.0 score of 8.4 reflects high integrity and availability impact across both the ArcadeDB process and the underlying OS filesystem.
Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exposes no authentication gate, letting anyone who can reach the Redis port read, write, and delete records across any database on the server. VulnCheck reported the flaw (CWE-306, Missing Authentication) with a CVSS 4.0 base score of 9.3, reflecting network-reachable, no-privilege exploitation with high confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, and it is not listed in CISA KEV.
Cross-database authorization bypass in ArcadeDB's Gremlin wire-protocol plugin allows any authenticated server user to fully access all databases on the server, completely circumventing per-database and per-type ACLs. Versions 26.7.3 and below of com.arcadedb:arcadedb-gremlin are affected; the plugin enforces SASL PLAIN authentication but never invokes the database permission check (canAccessToDatabase) nor binds the authenticated principal into the execution engine. No public exploit code has been identified at time of analysis, but exploitation requires only a single valid server credential regardless of what database that credential was originally provisioned for.
Authentication bypass in ArcadeDB before 26.8.1 lets unauthenticated attackers run full CRUD operations against any database through the MongoDB wire-protocol plugin on TCP port 27017. The plugin negotiates a SASL handshake but never actually enforces it on data commands (insert, find, update, delete, create), so an attacker who can reach the port gains complete read/write access with no credentials. Reported by VulnCheck; no public exploit code has been identified at time of analysis, though the trivial reproduction path makes weaponization straightforward.
Privilege escalation in ArcadeDB server (versions 26.7.3 and earlier) allows a low-privileged authenticated user with read-only access to a single database to gain full server-wide administrative control. The flaw stems from the server failing to bind the authenticated principal to asynchronous command worker threads, so a JavaScript command submitted with awaitResponse:false runs with no user context and bypasses the scripting authorization gate entirely. VulnCheck reported the issue; there is no public exploit identified at time of analysis, but the mechanics are fully documented in the vendor advisory, making exploitation straightforward.
Missing authorization in ArcadeDB's DELETE FUNCTION SQL command allows any authenticated database user to permanently remove server-side functions regardless of their actual permission level. All releases up to and including 26.7.3 are affected; the issue is resolved in 26.8.1. No public exploit has been identified at time of analysis, but the low barrier - a valid database credential and a single API call - makes this easily reachable by insiders or compromised low-privilege accounts, particularly where server-side functions enforce security or business logic.
Server-side request forgery in ArcadeDB before 26.8.1 enables authenticated attackers to bypass the IMPORT DATABASE command's hostname validator by exploiting a time-of-check/time-of-use gap: the validator resolves a hostname once, but the subsequent HTTP connection re-resolves it independently and follows redirects. This allows DNS rebinding or redirect-based bypass to reach cloud metadata endpoints such as the AWS IMDSv1 service, internal network services, or arbitrary local files on the host. No public exploit is identified at time of analysis, but the techniques involved are well-documented and the cloud credential exposure impact is severe on default cloud deployments.
Privilege escalation in ArcadeDB before 26.8.1 lets a low-privileged authenticated reader escalate to full server administrator via the gRPC transaction interface. Because the server fails to bind the authenticated principal to the gRPC transaction executor thread in beginTransaction, an attacker can call executeCommand with a valid transaction ID to run arbitrary JavaScript that bypasses scripting authorization, ultimately creating server-wide admin accounts. Reported by VulnCheck with a linked GitHub security advisory; no public exploit is identified at time of analysis, and the flaw carries a CVSS 4.0 base score of 9.4.
Arbitrary file read in ArcadeDB's OpenCypher LOAD CSV FROM clause allows any authenticated user with read query privileges to exfiltrate arbitrary server-side files. All versions prior to 26.8.1 are affected, as confirmed by the vendor's GitHub security advisory GHSA-hfp5-6gcp-8c75. An attacker issuing a crafted LOAD CSV FROM 'file:///etc/shadow' statement receives the file contents directly in the query response, exposing credentials, private keys, and configuration data readable by the server process - no public exploit or CISA KEV listing has been identified at time of analysis.
Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to escape the GraalVM JavaScript sandbox and read any file accessible to the ArcadeDB server process on the underlying host. The sandbox allowlist enforces package name restrictions via unescaped regular expressions, which an attacker can craft to match unintended Java class names and instantiate ZipFile or JarFile to open arbitrary filesystem paths. No public exploit has been identified at time of analysis; however, the vendor-confirmed patch to 26.8.1 should be applied promptly given the high confidentiality impact and the sensitivity of files typically reachable by a database server process.
Privilege escalation in ArcadeDB before 26.7.3 allows any authenticated MCP user to fully bypass the database authorization framework. The MCP HTTP transport layer fails to bind the authenticated principal into the engine's permission context, causing all access control checks to silently resolve as no-ops regardless of the user's actual role. Affected users can perform arbitrary DDL, schema mutations, unrestricted database writes, and execute arbitrary JavaScript via the query tool - effectively gaining root-level database access from a low-privileged account. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, though the impact is severe for any deployment with MCP transport enabled.
Cleartext leakage of the HA cluster token in ArcadeDB's MCP get_server_settings tool allows any authenticated MCP user to escalate to full root-level server control in all versions before 26.7.3. The exposed arcadedb.ha.clusterToken can be replayed via the X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User HTTP headers to impersonate the root user, turning a low-privilege information disclosure into a complete server compromise. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the chained privilege escalation path significantly elevates real-world impact beyond the CWE-200 classification suggests.
Privilege escalation in ArcadeDB before 26.7.3 allows any user holding UPDATE_SCHEMA permission to create server-wide administrator accounts by crafting malicious JavaScript triggers. The root cause is that the real LocalDatabase object is bound into trigger execution contexts with GraalVM's HostAccess.ALL policy, exposing the full Java security API - including getSecurity().createUser() - without permission checks. No public exploit has been identified at time of analysis, but a vendor-released patch is available in 26.7.3 per the GitHub security advisory GHSA-38pf-6hp2-pxww.
Remote OS command execution in ArcadeDB before 26.7.2 is reachable by authenticated schema administrators through JavaScript trigger scripts, because ScriptTriggerExecutor grants sandbox access to the full java.lang.* package, allowing direct invocation of java.lang.Runtime.getRuntime().exec() or ProcessBuilder. Any account holding UPDATE_SCHEMA permission can create a trigger that fires OS commands server-side against the underlying host process. No public exploit has been identified at time of analysis, but SSVC rates the technical impact as total and the attack as automatable, and the GHSA advisory provides sufficient implementation detail to lower the barrier for capable threat actors.
Permission bypass in ArcadeDB before 26.7.2 allows authenticated read-only users to execute privileged schema-mutation SQL operations that should require the UPDATE_SCHEMA permission. A user holding only a read-only API token can submit ALTER TYPE ... CUSTOM or ALTER TYPE ... BUCKETSELECTIONSTRATEGY statements to the HTTP command endpoint, invoking setCustomValue and setBucketSelectionStrategy on LocalDocumentType without any permission enforcement. The consequence is unauthorized corruption of schema metadata and bucket-selection strategy, potentially disrupting record routing and data integrity across the database. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV; a vendor-released patch is available in version 26.7.2.
Scripting authorization bypass in ArcadeDB before 26.7.2 lets any authenticated database user - including read-only roles - run sandboxed JavaScript by submitting a SQL 'DEFINE FUNCTION ... LANGUAGE js' statement, defeating a control that was supposed to restrict scripting to security administrators. The prior GHSA-48qw-824m-86pr hardening added a UPDATE_SECURITY permission gate to the polyglot engine, but the SQL route to JavaScript never invokes it, so low-privilege users regain the very capability the gate was meant to remove. Reported by VulnCheck; the vendor advisory publicly documents a complete two-request exploitation recipe, and the vendor scores it CVSS 4.0 9.3 (Critical), though the runtime sandbox meaningfully limits real-world impact.
Cluster token exposure in ArcadeDB before 26.7.2 enables any authenticated user to escalate privileges to root-level administrative control. The GET /api/v1/server management endpoint returns the arcadedb.ha.clusterToken value in cleartext, which an attacker can replay via the X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User HTTP headers to impersonate the root account. This two-stage privilege escalation grants full administrative capabilities including user creation, arbitrary database operations, and server shutdown - representing a near-total system compromise for any multi-tenant or shared ArcadeDB deployment. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the exploitation path is mechanically trivial once credentials are obtained.
Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the server by supplying an arbitrary {database} parameter to the time series (/ts/*), batch, Prometheus, and Grafana HTTP handlers. Roughly 14 endpoints resolve the target database and call getDatabase(...) without invoking canAccessToDatabase(...), so a caller scoped to one database (or, per the code, potentially an anonymous request) gains full read/write over databases they were never granted. Reported by VulnCheck with a vendor patch (26.7.2) available; the GHSA advisory publishes concrete exploitation requests, and while EPSS is not provided the CVSS 4.0 base score is 9.3 (Critical). This is not in CISA KEV.
ArcadeDB versions 21.12.1 through 26.10.1 allow an authenticated user who holds only the readRecord privilege to overwrite the database's shared GraphQL schema through the read-only /api/v1/query/{database} endpoint, so later GraphQL queries issued by other users - including administrators - return the attacker-chosen result. The root cause is a missing authorization check (CWE-862): a GraphQL type definition carrying a crafted @sql directive was not treated as a schema change, even though the same user is correctly refused a CREATE DOCUMENT TYPE with 403 for lacking updateSchema. The vendor fixed this in 26.10.2; there is no CISA KEV listing or exploitation reporting, and because directive statements execute with the querying user's own privileges there is no data write and no privilege escalation - only manipulation of what other users see. A public proof-of-concept walkthrough is included in the vendor advisory; it is a documented reproduction, not verified working exploit code.
ArcadeDB versions 26.2.1 through 26.10.0 expose a missing authorization check in the Bolt protocol handler that lets any user holding credentials for one database read schema metadata - labels and index definitions - belonging to other databases on the same server. Because the handler trusts the attacker-supplied db field in RUN or BEGIN messages rather than validating the caller's authorization for that database, a low-privileged authenticated user can pivot across tenants with a single message field and calls to db.labels() or SHOW INDEXES. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; impact is confined to read-only information disclosure (no data content, no writes, no availability effect), so real risk concentrates in multi-database or multi-tenant deployments that depend on database-level isolation.
Authenticated users with credentials for any single ArcadeDB database can issue a SHOW DATABASES query over the Bolt protocol to enumerate every database name on the instance, exposing tenant or project identifiers beyond their authorized database. The issue affects ArcadeDB versions from 26.2.1 before 26.10.1 and is rooted in a missing authorization check (CWE-862) in the Bolt handler; impact is limited to database-name disclosure rather than database contents. The assessed CVSS 3.1 score is 5.3, reflecting network reachability but a requirement for valid credentials and only low confidentiality impact; no public exploit identified at time of analysis.
Read-only authenticated ArcadeDB accounts can persistently rewrite edge-type storage declarations because the ALTER TYPE schema-flag path skips the UPDATE_SCHEMA permission check, letting a low-privileged user flip 'lightweight' and 'unique' flags on edge types across releases 26.8.1 up to (but not including) 26.10.1. The command can be delivered as a bare ALTER TYPE edgeType WITH lightweight = true statement over the HTTP, gRPC, or Bolt command API and survives as a lasting schema change, so integrity of the graph model is affected while no data disclosure, deletion, or outage is described. The issue requires an authenticated account with at least read-only privileges (CVSS PR:L), is not remotely unauthenticated, and no public exploit code or CISA KEV entry is associated with it at time of analysis; a fixed release, 26.10.1, has been published by the vendor.
Server-side request forgery in ArcadeDB versions before 26.9.1 allows an authenticated user to bypass the built-in SSRF guard by supplying hostnames that resolve to IPv6 transition addresses (NAT64, 6to4, or Teredo) which embed RFC 1918 or loopback IPv4 targets, causing IMPORT DATABASE and server commands to fetch internal-only resources on the attacker's behalf. Exploitation requires valid credentials and permission to invoke the URL-fetching command, and meaningful impact depends on reachable internal services - most notably a cloud instance metadata endpoint such as 169.254.169.254 - being network-accessible from the ArcadeDB host; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects low confidentiality and integrity impact with a scope change and no availability impact. No public exploit identified at time of analysis, and there is no confirmed active exploitation (CISA KEV); the vendor advisory notes that patches are available, making this a medium-priority credentialed issue rather than an urgent one.
An authenticated, low-privilege ArcadeDB user can bypass per-type record ACLs and durably append graph edges to protected vertex types in versions before 26.9.1. The flaw is an incomplete fix of GHSA-c23x-pqcj-7hfm: the authenticated principal is bound only on the HTTP handler thread, while the async worker threads used by the parallel edge-connect phase of POST /api/v1/batch/{database} carry no current user, so LocalDatabase.checkPermissionsOnFile returns early and the CREATE_RECORD/UPDATE_RECORD checks on the target vertex type are never enforced. The attacker must already hold CREATE_RECORD on some edge type and submit an edge-load batch with parallelFlush left at its default of true; setting parallelFlush=false causes the request to be correctly rejected. Impact is confined to integrity of graph adjacency - no protected data is read and there is no denial of service - and no public exploit identified at time of analysis; a vendor patch is available in 26.9.1.
Batch and time-series HTTP handlers in ArcadeDB before 26.8.1 omit the setCurrentUser call when dispatching work to worker threads, causing the fine-grained per-type ACL layer to silently skip authorization checks for those endpoints. Authenticated users with restricted per-type permissions can read from and write to data types they are not authorized to access by routing requests through the affected handlers. No public exploit has been identified and the CVSS 4.0 score of 2.3 reflects the narrow exploitation prerequisites - only deployments actively using per-type or per-group ACLs are vulnerable.
Authorization bypass in ArcadeDB's MCP server-level set_server_setting tool allows authenticated read-only users to modify global server configuration in versions 26.4.2 through 26.7.3. SetServerSettingTool.execute() validates only the global allowAdmin flag and omits any role-level check, meaning any user with valid credentials - regardless of their assigned role - can invoke the tool when the MCP deployment is configured with allowAdmin=true and a non-root allowedUsers list. Successful exploitation enables configuration tampering of GlobalConfiguration or deliberate denial of service. No public exploit identified at time of analysis and this vulnerability is not listed in CISA KEV; the issue is fixed in 26.8.1.
Heap memory exhaustion in ArcadeDB's Cypher query engine allows authenticated users to trigger OutOfMemoryError and cause temporary service unavailability. Attackers with valid database credentials can submit crafted Cypher range() expressions with abnormally large bounds, consuming server heap until the JVM is starved of resources. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the authenticated prerequisite meaningfully limits attacker pool.
Cross-database information disclosure in ArcadeDB versions up to and including 26.7.3 allows any authenticated user to enumerate the full server database registry via the Raft cluster-info endpoints (GetClusterHandler and PostBootstrapStateHandler), which authenticate requests but perform no authorization check. Affected deployments are limited to HA clusters with arcadedb.ha.enabled configured and the ha-raft module loaded. Exposed metadata includes database names, last transaction IDs, bootstrap fingerprints, and cluster peer/leader topology - enabling cross-tenant reconnaissance in shared environments. No public exploit has been identified at time of analysis; vendor-released patch is available in version 26.8.1.