CVE-2026-67340_exploit

CVE-2026-67340 — ArcadeDB RCE post-autenticación mediante script de disparador JAVASCRIPT Ejecución remota de código posterior a la autenticación en ArcadeDB una base de datos Java multimodelo mediante un disparador JAVASCRIPT que accede a clases del host. El motor políglota de GraalVM de un...

CVE-2026-75855

Título El path traversal en los comandos de servidor "create database" / "drop database" permite la escritura y eliminación arbitraria de archivos fuera del directorio de base de datos configurado Resumen El endpoint POST /api/v1/server en sus comandos create database y drop database utiliza el...

CVE-2026-93597

ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services a...

CVE-2026-93598

ArcadeDB Maven artifact com.arcadedb:arcadedb-engine through 26.8.1 contains an incomplete deny-list in the polyglot script sandbox: com.arcadedb.query.polyglot.HostClassLookupFilter.DENIED lists java.util.ResourceBundle as a bare class name, which is matched by exact equality and therefore does...

CVE-2026-93594

ArcadeDB Maven artifact com.arcadedb:arcadedb-engine through 26.8.1 enforces its per-type/per-record access-control rules only in LocalBucket, keyed on file id. Query-execution paths that reach record data through LSM index files or the TimeSeries engine never invoke that permission check, so an...

CVE-2026-93595

ArcadeDB before 26.9.1 contains an access control bypass vulnerability in the querydatabase tool exposed through the AI chat endpoints. The tool executes queries without binding the authenticated principal to DatabaseContext, causing per-type and per-bucket ACL checks to silently no-op and allowi...

CVE-2026-93593

ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver builds permissions from bucket IDs, but TimeSeries types do not own normal record buckets. An authenticated low-privilege user can read or insert TimeSeries samples despite...

CVE-2026-93596

ArcadeDB before 26.9.1 com.arcadedb:arcadedb-engine outedges/inedges buckets, resulting in unauthorized modification of graph adjacency. Setting parallelFlush=false causes the request to be correctly rejected. This is an incomplete fix of GHSA-c23x-pqcj-7hfm, which bound the principal only on the...

CVE-2026-93598

ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 contains an incomplete deny-list in its polyglot script sandbox. The class HostClassLookupFilter.DENIED lists java.util.ResourceBundle as a bare class name matched by exact equality, which does not cover its subclasses, while S...

CVE-2026-93598 ArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundle

ArcadeDB Maven artifact com.arcadedb:arcadedb-engine through 26.8.1 contains an incomplete deny-list in the polyglot script sandbox: com.arcadedb.query.polyglot.HostClassLookupFilter.DENIED lists java.util.ResourceBundle as a bare class name, which is matched by exact equality and therefore does...

CVE-2026-93598 ArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundle

ArcadeDB Maven artifact com.arcadedb:arcadedb-engine through 26.8.1 contains an incomplete deny-list in the polyglot script sandbox: com.arcadedb.query.polyglot.HostClassLookupFilter.DENIED lists java.util.ResourceBundle as a bare class name, which is matched by exact equality and therefore does...

EUVD-2026-82893

ArcadeDB Maven artifact com.arcadedb:arcadedb-engine through 26.8.1 contains an incomplete deny-list in the polyglot script sandbox: com.arcadedb.query.polyglot.HostClassLookupFilter.DENIED lists java.util.ResourceBundle as a bare class name, which is matched by exact equality and therefore does...

CVE-2026-93598 ArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundle

ArcadeDB Maven artifact com.arcadedb:arcadedb-engine through 26.8.1 contains an incomplete deny-list in the polyglot script sandbox: com.arcadedb.query.polyglot.HostClassLookupFilter.DENIED lists java.util.ResourceBundle as a bare class name, which is matched by exact equality and therefore does...

CVE-2026-93597 ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses

ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services a...

CVE-2026-93597 ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses

ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services a...

CVE-2026-93596 ArcadeDB before 26.9.1 Authorization Bypass via Batch Edge Connect

ArcadeDB before 26.9.1 com.arcadedb:arcadedb-engine outedges/inedges buckets, resulting in unauthorized modification of graph adjacency. Setting parallelFlush=false causes the request to be correctly rejected. This is an incomplete fix of GHSA-c23x-pqcj-7hfm, which bound the principal only on the...

EUVD-2026-82891

ArcadeDB before 26.9.1 com.arcadedb:arcadedb-engine outedges/inedges buckets, resulting in unauthorized modification of graph adjacency. Setting parallelFlush=false causes the request to be correctly rejected. This is an incomplete fix of GHSA-c23x-pqcj-7hfm, which bound the principal only on the...

CVE-2026-93597

ArcadeDB versions before 26.9.1 contain a Server-Side Request Forgery (SSRF) vulnerability in the SSRF guard used by the IMPORT DATABASE and server commands. The root cause is a failure to validate IPv6 transition addresses (NAT64, 6to4, or Teredo), allowing an authenticated attacker to supply UR...

CVE-2026-93596

ArcadeDB (com.arcadedb:arcadedb-engine) versions before 26.9.1 (≤ 26.8.1) suffer an authorization bypass in the parallel edge-connect phase of POST /api/v1/batch/{database}. The authenticated principal is not bound onto the DatabaseAsyncTransaction async worker threads, causing LocalDatabase.chec...

EUVD-2026-82892

ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services a...