CVE-2026-75843

creationtimestamp| type| source ---|---|--- 2026-08-18 12:10:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mte6pgeyfk2j 2026-08-18 14:08:20+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtefcudxoh25...

CVE-2026-75843

ArcadeDB versions before 26.8.1 fail to bind the authenticated principal on the gRPC transaction executor thread during beginTransaction, letting authenticated readers bypass scripting authorization and execute arbitrary JavaScript that creates server-wide admin accounts. Patch to 26.8.1 or later...