CVE-2026-93598 ArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundle

ArcadeDB Maven artifact com.arcadedb:arcadedb-engine through 26.8.1 contains an incomplete deny-list in the polyglot script sandbox: com.arcadedb.query.polyglot.HostClassLookupFilter.DENIED lists java.util.ResourceBundle as a bare class name, which is matched by exact equality and therefore does...

CVE-2026-93596 ArcadeDB before 26.9.1 Authorization Bypass via Batch Edge Connect

ArcadeDB before 26.9.1 com.arcadedb:arcadedb-engine outedges/inedges buckets, resulting in unauthorized modification of graph adjacency. Setting parallelFlush=false causes the request to be correctly rejected. This is an incomplete fix of GHSA-c23x-pqcj-7hfm, which bound the principal only on the...

CVE-2026-93596: Missing Authorization

ArcadeDB before 26.9.1 com.arcadedb:arcadedb-engine = 26.8.1 fails to bind the authenticated principal onto the DatabaseAsyncTransaction async worker threads used by the parallel edge-connect phase of POST /api/v1/batch/database. Because those workers have no current user,...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.3), com.arcadedb:arcadedb-console (>=21.9.1-beta, <=26.7.3) +22 more potentially affected by CVE-2026-76225 via com.arcadedb:arcadedb-engine (>=21.9.1-beta, <=26.7.3)

com.arcadedb:arcadedb-engine MAVEN version =21.9.1-beta, =26.2.1, =21.9.1-beta, =21.9.1-beta, =21.12.1, =21.9.1-beta, =25.9.1, =25.9.1, =25.9.1, =26.4.2, =21.9.1-beta, =25.1.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =26.7.3 and more Source cves: CVE-2026-76225 Source advisory:...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.3), com.arcadedb:arcadedb-console (>=21.9.1-beta, <=26.7.3) +22 more potentially affected by CVE-2026-76223 via com.arcadedb:arcadedb-engine (>=21.9.1-beta, <=26.7.3)

com.arcadedb:arcadedb-engine MAVEN version =21.9.1-beta, =26.2.1, =21.9.1-beta, =21.9.1-beta, =21.12.1, =21.9.1-beta, =25.9.1, =25.9.1, =25.9.1, =26.4.2, =21.9.1-beta, =25.1.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =26.7.3 and more Source cves: CVE-2026-76223 Source advisory:...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.3), com.arcadedb:arcadedb-console (>=21.9.1-beta, <=26.7.3) +22 more potentially affected by CVE-2026-75846 via com.arcadedb:arcadedb-engine (>=21.9.1-beta, <=26.7.3)

com.arcadedb:arcadedb-engine MAVEN version =21.9.1-beta, =26.2.1, =21.9.1-beta, =21.9.1-beta, =21.12.1, =21.9.1-beta, =25.9.1, =25.9.1, =25.9.1, =26.4.2, =21.9.1-beta, =25.1.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =26.7.3 and more Source cves: CVE-2026-75846 Source advisory:...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.3), com.arcadedb:arcadedb-console (>=21.9.1-beta, <=26.7.3) +22 more potentially affected by CVE-2026-75844 via com.arcadedb:arcadedb-engine (>=21.9.1-beta, <=26.7.3)

com.arcadedb:arcadedb-engine MAVEN version =21.9.1-beta, =26.2.1, =21.9.1-beta, =21.9.1-beta, =21.12.1, =21.9.1-beta, =25.9.1, =25.9.1, =25.9.1, =26.4.2, =21.9.1-beta, =25.1.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =26.7.3 and more Source cves: CVE-2026-75844 Source advisory:...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.3), com.arcadedb:arcadedb-console (>=21.9.1-beta, <=26.7.3) +22 more potentially affected by CVE-2026-75842 via com.arcadedb:arcadedb-engine (>=21.9.1-beta, <=26.7.3)

com.arcadedb:arcadedb-engine MAVEN version =21.9.1-beta, =26.2.1, =21.9.1-beta, =21.9.1-beta, =21.12.1, =21.9.1-beta, =25.9.1, =25.9.1, =25.9.1, =26.4.2, =21.9.1-beta, =25.1.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =26.7.3 and more Source cves: CVE-2026-75842 Source advisory:...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.3), com.arcadedb:arcadedb-console (>=21.9.1-beta, <=26.7.3) +22 more potentially affected by CVE-2026-75840 via com.arcadedb:arcadedb-engine (>=21.9.1-beta, <=26.7.3)

com.arcadedb:arcadedb-engine MAVEN version =21.9.1-beta, =26.2.1, =21.9.1-beta, =21.9.1-beta, =21.12.1, =21.9.1-beta, =25.9.1, =25.9.1, =25.9.1, =26.4.2, =21.9.1-beta, =25.1.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =26.7.3 and more Source cves: CVE-2026-75840 Source advisory:...

CVE-2026-67340

ArcadeDB before 26.7.2 arcadedb-engine allows trigger scripts to look up host classes in java.lang. via Java.type because ScriptTriggerExecutor adds java.lang. to the allowed packages. An authenticated user with UPDATESCHEMA permission can create a JavaScript trigger that invokes...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.1), com.arcadedb:arcadedb-console (>=21.9.1-beta, <=26.7.1) +20 more potentially affected by CVE-2026-67340 via com.arcadedb:arcadedb-engine (>=21.9.1-beta, <=26.7.1)

com.arcadedb:arcadedb-engine MAVEN version =21.9.1-beta, =26.2.1, =21.9.1-beta, =21.9.1-beta, =21.12.1, =21.9.1-beta, =25.9.1, =25.9.1, =25.9.1, =26.4.2, =21.9.1-beta, =25.1.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =26.7.1 and more Source cves: CVE-2026-67340 Source advisory:...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.1), com.arcadedb:arcadedb-console (>=21.9.1-beta, <=26.7.1) +20 more potentially affected by CVE-2026-67344 via com.arcadedb:arcadedb-engine (>=21.9.1-beta, <=26.7.1)

com.arcadedb:arcadedb-engine MAVEN version =21.9.1-beta, =26.2.1, =21.9.1-beta, =21.9.1-beta, =21.12.1, =21.9.1-beta, =25.9.1, =25.9.1, =25.9.1, =26.4.2, =21.9.1-beta, =25.1.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =26.7.1 and more Source cves: CVE-2026-67344 Source advisory:...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.1), com.arcadedb:arcadedb-console (>=21.9.1-beta, <=26.7.1) +20 more potentially affected by CVE-2026-67341 via com.arcadedb:arcadedb-engine (>=21.9.1-beta, <=26.7.1)

com.arcadedb:arcadedb-engine MAVEN version =21.9.1-beta, =26.2.1, =21.9.1-beta, =21.9.1-beta, =21.12.1, =21.9.1-beta, =25.9.1, =25.9.1, =25.9.1, =26.4.2, =21.9.1-beta, =25.1.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =26.7.1 and more Source cves: CVE-2026-67341 Source advisory:...

CVE-2026-67340: Improper Control of Generation of Code

ArcadeDB before 26.7.2 arcadedb-engine allows trigger scripts to look up host classes in java.lang. via Java.type because ScriptTriggerExecutor adds java.lang. to the allowed packages. An authenticated user with UPDATESCHEMA permission can create a JavaScript trigger that invokes...

Server-Side Request Forgery (SSRF)

com.arcadedb:arcadedb-engine is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to the IMPORT DATABASE statement accepting unvalidated source URLs without requiring administrative privileges, which allows an authenticated attacker to issue requests to arbitrary internal o...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.1), com.arcadedb:arcadedb-console (>=26.1.1, <=26.7.1) +18 more potentially affected by unknown CVE via com.arcadedb:arcadedb-engine (>=26.1.1, <=26.7.1)

com.arcadedb:arcadedb-engine MAVEN version =26.1.1, =26.2.1, =26.1.1, =26.1.1, =26.1.1, =26.1.1, =26.1.1, =26.1.1, =26.4.2, =26.1.1, =26.1.1, =26.1.1, =26.1.1, =26.1.1, =26.1.1, =26.1.1, =26.7.1 and more Source cves: unknown CVE Source advisory: GHSA-VWJC-V7X7-CM6G...

com.arcadedb:arcadedb-console (25.5.1), com.arcadedb:arcadedb-graphql (25.5.1) +9 more potentially affected by CVE-2026-67341 via com.arcadedb:arcadedb-engine (25.5.1)

com.arcadedb:arcadedb-engine MAVEN version 25.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.arcadedb:arcadedb-engine and may be impacted: - com.arcadedb:arcadedb-console 25.5.1 - com.arcadedb:arcadedb-graphql 25.5.1 -...

com.arcadedb:arcadedb-console (23.6.1), com.arcadedb:arcadedb-coverage (23.6.1) +8 more potentially affected by CVE-2026-67341 via com.arcadedb:arcadedb-engine (23.6.1)

com.arcadedb:arcadedb-engine MAVEN version 23.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.arcadedb:arcadedb-engine and may be impacted: - com.arcadedb:arcadedb-console 23.6.1 - com.arcadedb:arcadedb-coverage 23.6.1 -...

com.arcadedb:arcadedb-console (23.1.2), com.arcadedb:arcadedb-coverage (23.1.2) +8 more potentially affected by CVE-2026-67341 via com.arcadedb:arcadedb-engine (23.1.2)

com.arcadedb:arcadedb-engine MAVEN version 23.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.arcadedb:arcadedb-engine and may be impacted: - com.arcadedb:arcadedb-console 23.1.2 - com.arcadedb:arcadedb-coverage 23.1.2 -...

com.arcadedb:arcadedb-console (25.11.1), com.arcadedb:arcadedb-graphql (25.11.1) +13 more potentially affected by CVE-2026-67341 via com.arcadedb:arcadedb-engine (25.11.1)

com.arcadedb:arcadedb-engine MAVEN version 25.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.arcadedb:arcadedb-engine and may be impacted: - com.arcadedb:arcadedb-console 25.11.1 - com.arcadedb:arcadedb-graphql 25.11.1 -...