CVE-2026-75855

Title Path Traversal in "create database" / "drop database" server commands allows arbitrary file write and delete outside the configured database directory Summary The POST /api/v1/server endpoint's create database and drop database commands use the caller-supplied database name to build a...

CVE-2026-67340_exploit

CVE-2026-67340 — ArcadeDB JAVASCRIPT Trigger-Script RCE post-auth Post-authentication remote code execution in ArcadeDB a Java multi-model database via a JAVASCRIPT trigger that reaches host classes. A trigger's GraalVM polyglot engine is built with a host-class allow-list that includes java.lang...

CVE-2026-119577

ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDB, or Redis wire-protocol connections. Attackers holding an existing connection can keep reading and writing data after deletion, grant...

CVE-2026-119575

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then iss...

CVE-2026-119576

ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only query endpoint. Attackers can send a GraphQL type definition with a crafted @sql directive to /api/v1/query/database,...

EUVD-2026-113931

ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDB, or Redis wire-protocol connections. Attackers holding an existing connection can keep reading and writing data after deletion, grant...

CVE-2026-119577 ArcadeDB before 26.10.2 Improper Session Revocation in Wire-Protocol Connections

ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDB, or Redis wire-protocol connections. Attackers holding an existing connection can keep reading and writing data after deletion, grant...

CVE-2026-119577 ArcadeDB before 26.10.2 Improper Session Revocation in Wire-Protocol Connections

ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDB, or Redis wire-protocol connections. Attackers holding an existing connection can keep reading and writing data after deletion, grant...

CVE-2026-119577 ArcadeDB before 26.10.2 Improper Session Revocation in Wire-Protocol Connections

ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDB, or Redis wire-protocol connections. Attackers holding an existing connection can keep reading and writing data after deletion, grant...

CVE-2026-119577

ArcadeDB versions before 26.10.2 are susceptible to an improper authorization vulnerability regarding session revocation in wire-protocol connections (Postgres, Bolt, MongoDB, and Redis). The root cause is that executors retain a stale ServerSecurityUser object, allowing users whose permissions w...

EUVD-2026-113930

ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only query endpoint. Attackers can send a GraphQL type definition with a crafted @sql directive to /api/v1/query/database,...

CVE-2026-119576

ArcadeDB versions 21.12.1 before 26.10.2 are vulnerable to an authorization bypass that allows users with minimal readRecord privileges to replace the shared GraphQL schema via a read-only query endpoint. By sending a GraphQL type definition containing a crafted @sql directive to the /api/v1/quer...

CVE-2026-119576 ArcadeDB from 21.12.1 before 26.10.2 GraphQL Schema Replacement via Read-Only Query Endpoint

ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only query endpoint. Attackers can send a GraphQL type definition with a crafted @sql directive to /api/v1/query/database,...

CVE-2026-119576 ArcadeDB from 21.12.1 before 26.10.2 GraphQL Schema Replacement via Read-Only Query Endpoint

ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only query endpoint. Attackers can send a GraphQL type definition with a crafted @sql directive to /api/v1/query/database,...

CVE-2026-119575 ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then iss...

EUVD-2026-113929

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then iss...

CVE-2026-119575

ArcadeDB versions 26.8.1 before 26.10.2 are vulnerable to a Server-Side Request Forgery (SSRF) . This vulnerability allows authenticated users with updateDatabaseSettings permissions to disable the LOAD CSV IP block list using the ALTER DATABASE command. By setting arcadedb.opencypher.loadCsv.blo...

CVE-2026-119575 ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then iss...

PT-2026-133545

ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only query endpoint. Attackers can send a GraphQL type definition with a crafted @sql directive to /api/v1/query/database,...

PT-2026-133544

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then iss...