Arcadedata

CVE	Summary	Severity	CVSS	EPSS	Priority
CVE-2026-75854	Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exposes no authentication gate, letting anyone who can reach the Redis port read, write, and delete records across any database on the server. VulnCheck reported the flaw (CWE-306, Missing Authentication) with a CVSS 4.0 base score of 9.3, reflecting network-reachable, no-privilege exploitation with high confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, and it is not listed in CISA KEV.	CRITICAL	9.3	1.1%	48
CVE-2026-75851	Privilege escalation in ArcadeDB server (versions 26.7.3 and earlier) allows a low-privileged authenticated user with read-only access to a single database to gain full server-wide administrative control. The flaw stems from the server failing to bind the authenticated principal to asynchronous command worker threads, so a JavaScript command submitted with awaitResponse:false runs with no user context and bypasses the scripting authorization gate entirely. VulnCheck reported the issue; there is no public exploit identified at time of analysis, but the mechanics are fully documented in the vendor advisory, making exploitation straightforward.	CRITICAL	9.4	0.3%	47
CVE-2026-75843	Privilege escalation in ArcadeDB before 26.8.1 lets a low-privileged authenticated reader escalate to full server administrator via the gRPC transaction interface. Because the server fails to bind the authenticated principal to the gRPC transaction executor thread in beginTransaction, an attacker can call executeCommand with a valid transaction ID to run arbitrary JavaScript that bypasses scripting authorization, ultimately creating server-wide admin accounts. Reported by VulnCheck with a linked GitHub security advisory; no public exploit is identified at time of analysis, and the flaw carries a CVSS 4.0 base score of 9.4.	CRITICAL	9.4	0.3%	47
CVE-2026-75852	Authentication bypass in ArcadeDB before 26.8.1 lets unauthenticated attackers run full CRUD operations against any database through the MongoDB wire-protocol plugin on TCP port 27017. The plugin negotiates a SASL handshake but never actually enforces it on data commands (insert, find, update, delete, create), so an attacker who can reach the port gains complete read/write access with no credentials. Reported by VulnCheck; no public exploit code has been identified at time of analysis, though the trivial reproduction path makes weaponization straightforward.	CRITICAL	9.3	0.5%	47
CVE-2026-67341	Scripting authorization bypass in ArcadeDB before 26.7.2 lets any authenticated database user - including read-only roles - run sandboxed JavaScript by submitting a SQL 'DEFINE FUNCTION ... LANGUAGE js' statement, defeating a control that was supposed to restrict scripting to security administrators. The prior GHSA-48qw-824m-86pr hardening added a UPDATE_SECURITY permission gate to the polyglot engine, but the SQL route to JavaScript never invokes it, so low-privilege users regain the very capability the gate was meant to remove. Reported by VulnCheck; the vendor advisory publicly documents a complete two-request exploitation recipe, and the vendor scores it CVSS 4.0 9.3 (Critical), though the runtime sandbox meaningfully limits real-world impact.	CRITICAL	9.3	0.3%	47
CVE-2026-67342	Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the server by supplying an arbitrary {database} parameter to the time series (/ts/*), batch, Prometheus, and Grafana HTTP handlers. Roughly 14 endpoints resolve the target database and call getDatabase(...) without invoking canAccessToDatabase(...), so a caller scoped to one database (or, per the code, potentially an anonymous request) gains full read/write over databases they were never granted. Reported by VulnCheck with a vendor patch (26.7.2) available; the GHSA advisory publishes concrete exploitation requests, and while EPSS is not provided the CVSS 4.0 base score is 9.3 (Critical). This is not in CISA KEV.	CRITICAL	9.3	0.3%	47
CVE-2026-76224	Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version 26.7.3 to full OS command execution by any authenticated user, including those with only read-only database roles. The flaw is a silent fallback in ArcadeGremlin.executeStatement() that routes parameterized queries failing gremlin-lang parsing to the unrestricted Groovy scripting engine, which can invoke arbitrary Java and OS-level code as the server process user. No public exploit has been identified at time of analysis, but the minimal privilege bar - any valid credential - makes this a critical upgrade priority for all ArcadeDB deployments.	HIGH	8.7	0.6%	44
CVE-2026-75853	Cross-database authorization bypass in ArcadeDB's Gremlin wire-protocol plugin allows any authenticated server user to fully access all databases on the server, completely circumventing per-database and per-type ACLs. Versions 26.7.3 and below of com.arcadedb:arcadedb-gremlin are affected; the plugin enforces SASL PLAIN authentication but never invokes the database permission check (canAccessToDatabase) nor binds the authenticated principal into the execution engine. No public exploit code has been identified at time of analysis, but exploitation requires only a single valid server credential regardless of what database that credential was originally provisioned for.	HIGH	8.7	0.4%	44
CVE-2026-75840	Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to escape the GraalVM JavaScript sandbox and read any file accessible to the ArcadeDB server process on the underlying host. The sandbox allowlist enforces package name restrictions via unescaped regular expressions, which an attacker can craft to match unintended Java class names and instantiate ZipFile or JarFile to open arbitrary filesystem paths. No public exploit has been identified at time of analysis; however, the vendor-confirmed patch to 26.8.1 should be applied promptly given the high confidentiality impact and the sensitivity of files typically reachable by a database server process.	HIGH	8.7	0.3%	44
CVE-2026-67343	Cluster token exposure in ArcadeDB before 26.7.2 enables any authenticated user to escalate privileges to root-level administrative control. The GET /api/v1/server management endpoint returns the arcadedb.ha.clusterToken value in cleartext, which an attacker can replay via the X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User HTTP headers to impersonate the root account. This two-stage privilege escalation grants full administrative capabilities including user creation, arbitrary database operations, and server shutdown - representing a near-total system compromise for any multi-tenant or shared ArcadeDB deployment. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the exploitation path is mechanically trivial once credentials are obtained.	HIGH	8.7	0.3%	44
CVE-2026-67356	Privilege escalation in ArcadeDB before 26.7.3 allows any user holding UPDATE_SCHEMA permission to create server-wide administrator accounts by crafting malicious JavaScript triggers. The root cause is that the real LocalDatabase object is bound into trigger execution contexts with GraalVM's HostAccess.ALL policy, exposing the full Java security API - including getSecurity().createUser() - without permission checks. No public exploit has been identified at time of analysis, but a vendor-released patch is available in 26.7.3 per the GitHub security advisory GHSA-38pf-6hp2-pxww.	HIGH	8.7	0.2%	44
CVE-2026-67340	Remote OS command execution in ArcadeDB before 26.7.2 is reachable by authenticated schema administrators through JavaScript trigger scripts, because ScriptTriggerExecutor grants sandbox access to the full java.lang.* package, allowing direct invocation of java.lang.Runtime.getRuntime().exec() or ProcessBuilder. Any account holding UPDATE_SCHEMA permission can create a trigger that fires OS commands server-side against the underlying host process. No public exploit has been identified at time of analysis, but SSVC rates the technical impact as total and the attack as automatable, and the GHSA advisory provides sufficient implementation detail to lower the barrier for capable threat actors.	HIGH	8.6	0.5%	44
CVE-2026-67344	Permission bypass in ArcadeDB before 26.7.2 allows authenticated read-only users to execute privileged schema-mutation SQL operations that should require the UPDATE_SCHEMA permission. A user holding only a read-only API token can submit ALTER TYPE ... CUSTOM or ALTER TYPE ... BUCKETSELECTIONSTRATEGY statements to the HTTP command endpoint, invoking setCustomValue and setBucketSelectionStrategy on LocalDocumentType without any permission enforcement. The consequence is unauthorized corruption of schema metadata and bucket-selection strategy, potentially disrupting record routing and data integrity across the database. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV; a vendor-released patch is available in version 26.7.2.	HIGH	8.5	0.1%	43
CVE-2026-75855	Path traversal in ArcadeDB versions before 26.8.1 enables authenticated root users to write and delete arbitrary files outside the designated database directory via the POST /api/v1/server REST API endpoint. By embedding ../ sequences within database names passed to create database or drop database commands, a root-privileged attacker can place files at arbitrary filesystem paths or recursively delete directories accessible to the server process. No public exploit has been identified and no CISA KEV listing exists, but the CVSS 4.0 score of 8.4 reflects high integrity and availability impact across both the ArcadeDB process and the underlying OS filesystem.	HIGH	8.4	0.4%	42
CVE-2026-75842	Arbitrary file read in ArcadeDB's OpenCypher LOAD CSV FROM clause allows any authenticated user with read query privileges to exfiltrate arbitrary server-side files. All versions prior to 26.8.1 are affected, as confirmed by the vendor's GitHub security advisory GHSA-hfp5-6gcp-8c75. An attacker issuing a crafted LOAD CSV FROM 'file:///etc/shadow' statement receives the file contents directly in the query response, exposing credentials, private keys, and configuration data readable by the server process - no public exploit or CISA KEV listing has been identified at time of analysis.	HIGH	8.3	0.3%	42

CVE-2026-75854

Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exposes no authentication gate, letting anyone who can reach the Redis port read, write, and delete records across any database on the server. VulnCheck reported the flaw (CWE-306, Missing Authentication) with a CVSS 4.0 base score of 9.3, reflecting network-reachable, no-privilege exploitation with high confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, and it is not listed in CISA KEV.

CRITICAL

9.3

1.1%

48

CVE-2026-75851

Privilege escalation in ArcadeDB server (versions 26.7.3 and earlier) allows a low-privileged authenticated user with read-only access to a single database to gain full server-wide administrative control. The flaw stems from the server failing to bind the authenticated principal to asynchronous command worker threads, so a JavaScript command submitted with awaitResponse:false runs with no user context and bypasses the scripting authorization gate entirely. VulnCheck reported the issue; there is no public exploit identified at time of analysis, but the mechanics are fully documented in the vendor advisory, making exploitation straightforward.

CRITICAL

9.4

0.3%

47

CVE-2026-75843

Privilege escalation in ArcadeDB before 26.8.1 lets a low-privileged authenticated reader escalate to full server administrator via the gRPC transaction interface. Because the server fails to bind the authenticated principal to the gRPC transaction executor thread in beginTransaction, an attacker can call executeCommand with a valid transaction ID to run arbitrary JavaScript that bypasses scripting authorization, ultimately creating server-wide admin accounts. Reported by VulnCheck with a linked GitHub security advisory; no public exploit is identified at time of analysis, and the flaw carries a CVSS 4.0 base score of 9.4.

CRITICAL

9.4

0.3%

47

CVE-2026-75852

Authentication bypass in ArcadeDB before 26.8.1 lets unauthenticated attackers run full CRUD operations against any database through the MongoDB wire-protocol plugin on TCP port 27017. The plugin negotiates a SASL handshake but never actually enforces it on data commands (insert, find, update, delete, create), so an attacker who can reach the port gains complete read/write access with no credentials. Reported by VulnCheck; no public exploit code has been identified at time of analysis, though the trivial reproduction path makes weaponization straightforward.

CRITICAL

9.3

0.5%

47

CVE-2026-67341

Scripting authorization bypass in ArcadeDB before 26.7.2 lets any authenticated database user - including read-only roles - run sandboxed JavaScript by submitting a SQL 'DEFINE FUNCTION ... LANGUAGE js' statement, defeating a control that was supposed to restrict scripting to security administrators. The prior GHSA-48qw-824m-86pr hardening added a UPDATE_SECURITY permission gate to the polyglot engine, but the SQL route to JavaScript never invokes it, so low-privilege users regain the very capability the gate was meant to remove. Reported by VulnCheck; the vendor advisory publicly documents a complete two-request exploitation recipe, and the vendor scores it CVSS 4.0 9.3 (Critical), though the runtime sandbox meaningfully limits real-world impact.

CRITICAL

9.3

0.3%

47

CVE-2026-67342

Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the server by supplying an arbitrary {database} parameter to the time series (/ts/*), batch, Prometheus, and Grafana HTTP handlers. Roughly 14 endpoints resolve the target database and call getDatabase(...) without invoking canAccessToDatabase(...), so a caller scoped to one database (or, per the code, potentially an anonymous request) gains full read/write over databases they were never granted. Reported by VulnCheck with a vendor patch (26.7.2) available; the GHSA advisory publishes concrete exploitation requests, and while EPSS is not provided the CVSS 4.0 base score is 9.3 (Critical). This is not in CISA KEV.

CRITICAL

9.3

0.3%

47

CVE-2026-76224

Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version 26.7.3 to full OS command execution by any authenticated user, including those with only read-only database roles. The flaw is a silent fallback in ArcadeGremlin.executeStatement() that routes parameterized queries failing gremlin-lang parsing to the unrestricted Groovy scripting engine, which can invoke arbitrary Java and OS-level code as the server process user. No public exploit has been identified at time of analysis, but the minimal privilege bar - any valid credential - makes this a critical upgrade priority for all ArcadeDB deployments.

HIGH

8.7

0.6%

44

CVE-2026-75853

Cross-database authorization bypass in ArcadeDB's Gremlin wire-protocol plugin allows any authenticated server user to fully access all databases on the server, completely circumventing per-database and per-type ACLs. Versions 26.7.3 and below of com.arcadedb:arcadedb-gremlin are affected; the plugin enforces SASL PLAIN authentication but never invokes the database permission check (canAccessToDatabase) nor binds the authenticated principal into the execution engine. No public exploit code has been identified at time of analysis, but exploitation requires only a single valid server credential regardless of what database that credential was originally provisioned for.

HIGH

8.7

0.4%

44

CVE-2026-75840

Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to escape the GraalVM JavaScript sandbox and read any file accessible to the ArcadeDB server process on the underlying host. The sandbox allowlist enforces package name restrictions via unescaped regular expressions, which an attacker can craft to match unintended Java class names and instantiate ZipFile or JarFile to open arbitrary filesystem paths. No public exploit has been identified at time of analysis; however, the vendor-confirmed patch to 26.8.1 should be applied promptly given the high confidentiality impact and the sensitivity of files typically reachable by a database server process.

HIGH

8.7

0.3%

44

CVE-2026-67343

Cluster token exposure in ArcadeDB before 26.7.2 enables any authenticated user to escalate privileges to root-level administrative control. The GET /api/v1/server management endpoint returns the arcadedb.ha.clusterToken value in cleartext, which an attacker can replay via the X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User HTTP headers to impersonate the root account. This two-stage privilege escalation grants full administrative capabilities including user creation, arbitrary database operations, and server shutdown - representing a near-total system compromise for any multi-tenant or shared ArcadeDB deployment. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the exploitation path is mechanically trivial once credentials are obtained.

HIGH

8.7

0.3%

44

CVE-2026-67356

Privilege escalation in ArcadeDB before 26.7.3 allows any user holding UPDATE_SCHEMA permission to create server-wide administrator accounts by crafting malicious JavaScript triggers. The root cause is that the real LocalDatabase object is bound into trigger execution contexts with GraalVM's HostAccess.ALL policy, exposing the full Java security API - including getSecurity().createUser() - without permission checks. No public exploit has been identified at time of analysis, but a vendor-released patch is available in 26.7.3 per the GitHub security advisory GHSA-38pf-6hp2-pxww.

HIGH

8.7

0.2%

44

CVE-2026-67340

Remote OS command execution in ArcadeDB before 26.7.2 is reachable by authenticated schema administrators through JavaScript trigger scripts, because ScriptTriggerExecutor grants sandbox access to the full java.lang.* package, allowing direct invocation of java.lang.Runtime.getRuntime().exec() or ProcessBuilder. Any account holding UPDATE_SCHEMA permission can create a trigger that fires OS commands server-side against the underlying host process. No public exploit has been identified at time of analysis, but SSVC rates the technical impact as total and the attack as automatable, and the GHSA advisory provides sufficient implementation detail to lower the barrier for capable threat actors.

HIGH

8.6

0.5%

44

CVE-2026-67344

Permission bypass in ArcadeDB before 26.7.2 allows authenticated read-only users to execute privileged schema-mutation SQL operations that should require the UPDATE_SCHEMA permission. A user holding only a read-only API token can submit ALTER TYPE ... CUSTOM or ALTER TYPE ... BUCKETSELECTIONSTRATEGY statements to the HTTP command endpoint, invoking setCustomValue and setBucketSelectionStrategy on LocalDocumentType without any permission enforcement. The consequence is unauthorized corruption of schema metadata and bucket-selection strategy, potentially disrupting record routing and data integrity across the database. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV; a vendor-released patch is available in version 26.7.2.

HIGH

8.5

0.1%

43

CVE-2026-75855

Path traversal in ArcadeDB versions before 26.8.1 enables authenticated root users to write and delete arbitrary files outside the designated database directory via the POST /api/v1/server REST API endpoint. By embedding ../ sequences within database names passed to create database or drop database commands, a root-privileged attacker can place files at arbitrary filesystem paths or recursively delete directories accessible to the server process. No public exploit has been identified and no CISA KEV listing exists, but the CVSS 4.0 score of 8.4 reflects high integrity and availability impact across both the ArcadeDB process and the underlying OS filesystem.

HIGH

8.4

0.4%

42

CVE-2026-75842

Arbitrary file read in ArcadeDB's OpenCypher LOAD CSV FROM clause allows any authenticated user with read query privileges to exfiltrate arbitrary server-side files. All versions prior to 26.8.1 are affected, as confirmed by the vendor's GitHub security advisory GHSA-hfp5-6gcp-8c75. An attacker issuing a crafted LOAD CSV FROM 'file:///etc/shadow' statement receives the file contents directly in the query response, exposing credentials, private keys, and configuration data readable by the server process - no public exploit or CISA KEV listing has been identified at time of analysis.

HIGH

8.3

0.3%

42

Severity Breakdown

Monthly CVE Trend

Affected Products (5)

Top Risky CVEs