PT-2026-67323

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.7.2 Description Authenticated users can retrieve the arcadedb.ha.clusterToken value in cleartext because the software fails to properly redact the cluster token in the 'GET /api/v1/server' endpoint. An attacker ca...

CVE-2026-67341: Incorrect Authorization

ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing security controls intended to restrict...

CVE-2026-67342: Authorization Bypass Through User-Controlled Key

ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling...

CVE-2026-67344: Missing Authorization

ArcadeDB before 26.7.2 fails to enforce the UPDATESCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access e.g., a...

CVE-2026-67343: Exposure of Sensitive Information to an Unauthorized Actor

ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing authenticated users to retrieve the arcadedb.ha.clusterToken value in cleartext. Attackers can use the leaked token with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User...

CVE-2026-67340: Improper Control of Generation of Code

ArcadeDB before 26.7.2 arcadedb-engine allows trigger scripts to look up host classes in java.lang. via Java.type because ScriptTriggerExecutor adds java.lang. to the allowed packages. An authenticated user with UPDATESCHEMA permission can create a JavaScript trigger that invokes...

Server-Side Request Forgery (SSRF)

com.arcadedb:arcadedb-engine is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to the IMPORT DATABASE statement accepting unvalidated source URLs without requiring administrative privileges, which allows an authenticated attacker to issue requests to arbitrary internal o...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization through the time-series, batch, Prometheus, and Grafana HTTP handlers in AbstractServerHttpHandler-based routes such as PostBatchHandler, PostTimeSeriesWriteHandler, PostTimeSeriesQueryHandler,...

ArcadeDB: Scripting authorization gate (GHSA-48qw-824m-86pr) bypassed via SQL DEFINE FUNCTION ... LANGUAGE js

The GHSA-48qw-824m-86pr hardening added a checkPermissionsOnDatabaseUPDATESECURITY gate on the polyglot engine PolyglotQueryEngine.java:112-114,126,176,199, but only there. The SQL route to JavaScript never touches it: DefineFunctionStatement.executeSimple DefineFunctionStatement.java:37-100,...

ArcadeDB: Trigger scripts run with java.lang.* allowed, enabling OS command execution (RCE)

ScriptTriggerExecutor sets allowedPackages to java.lang., java.util., java.time., java.math. ScriptTriggerExecutor.java:56; trigger creation is gated only at UPDATESCHEMA LocalSchema.createTrigger:636. Permitting java.lang. host-class lookup lets a trigger script do...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection through the ScriptTriggerExecutor in engine/src/main/java/com/arcadedb/schema/trigger/ScriptTriggerExecutor.java. An attacker can execute OS commands by creating a JavaScript trigger that uses...

GHSA-X9F9-R4M8-9XC2 ArcadeDB: Trigger scripts run with java.lang.* allowed, enabling OS command execution (RCE)

ScriptTriggerExecutor sets allowedPackages to java.lang., java.util., java.time., java.math. ScriptTriggerExecutor.java:56; trigger creation is gated only at UPDATESCHEMA LocalSchema.createTrigger:636. Permitting java.lang. host-class lookup lets a trigger script do...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the PolyglotQueryEngine scripting path in engine/src/main/java/com/arcadedb/query/polyglot/PolyglotQueryEngine.java and GraalPolyglotEngine.java. An attacker can execute language: "js" commands against PO...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the LocalDocumentType and LocalProperty schema-mutator methods. An attacker can mutate their database schema by sending DROP PROPERTY, ALTER TYPE, or ALTER PROPERTY requests with an authenticated identity that...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through IMPORT DATABASE in ImportDatabaseStatement, SourceDiscovery, and the import source handlers. An authenticated SQL user can trigger the flaw by supplying an IMPORT DATABASE URL or path that points...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through IMPORT DATABASE in ImportDatabaseStatement, SourceDiscovery, and the import source handlers. An authenticated SQL user can trigger the flaw by supplying an IMPORT DATABASE URL or path that points...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through IMPORT DATABASE in ImportDatabaseStatement, SourceDiscovery, and the import source handlers. An authenticated SQL user can trigger the flaw by supplying an IMPORT DATABASE URL or path that points...

PT-2026-67321

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.7.2 Description Insufficient authorization checks on the SQL DEFINE FUNCTION statement when using LANGUAGE js allow users with database access to execute arbitrary JavaScript code. This bypasses security controls...

PT-2026-67322

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.7.2 Description An authorization bypass exists in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints. The issue occurs because approximately 14 HTTP handlers resolve the database path paramete...

PT-2026-67320

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.7.2 Description An issue exists in the arcadedb-engine where trigger scripts can look up host classes in java.lang. via Java.type because the ScriptTriggerExecutor includes java.lang. in the allowed packages. An...