CVE-2026-93594

ArcadeDB prior to 26.7.1 allows a reader-role user to submit POST /api/v1/command/{database} with language: js because PolyglotQueryEngine.command, analyze, and registerFunctions do not enforce database-administrator authorization. GraalPolyglotEngine also permits scripts to bypass the allowedPackages whitelist by reflecting from the bound database object to arbitrary host classes.

In ArcadeDB prior to 26.6.1, the IMPORT DATABASE statement did not require administrative privileges and passed its source to the importer without validation. An authenticated user with SQL command access via /api/v1/command or /api/v1/query can supply HTTP/HTTPS destinations to make server-side requests to internal services, or file:// paths to read files accessible to the server process and ingest them as records. The XML importer also permits DTD processing and external entities.

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database without credentials.

ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials.

ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user, causing the scripting authorization gate to become a no-op. A user with only read access to a single database can submit an asynchronous JavaScript command via the /api/v1/command endpoint to run code with unrestricted host access and create a server-wide administrator, escalating to full administrative control. Fixed in 26.8.1.

ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run unrestricted JavaScript that creates server-wide administrator accounts.

ArcadeDB before version 26.7.2 contains an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints. Attackers can access and modify databases without proper permissions by directly calling affected endpoints with arbitrary database parameters.

ArcadeDB before version 26.7.2 fails to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing security controls intended to restrict scripting to administrators.

ArcadeDB versions 21.10.1 through 26.4.1 have two defects: (1) ServerSecurityUser.getDatabaseUser() returns a DB user with an uninitialized fileAccessMap, causing allow-all; (2) ArcadeDBServer.createDatabase() omits factory.setSecurity(...), disabling record-level authorization for new databases. An authenticated user or API token can read, write, and mutate schema on any other database on the same server.

ArcadeDB (com.arcadedb:arcadedb-engine) through 26.8.1 contains an incomplete deny-list in the polyglot script sandbox: HostClassLookupFilter.DENIED lists java.util.ResourceBundle as a bare class name, not covering subclasses, while ScriptTriggerExecutor.ALLOWED_PACKAGES permits java.util.*. A user with UPDATE_SCHEMA privilege can reference java.util.PropertyResourceBundle or java.util.ListResourceBundle and invoke ResourceBundle.getBundle(String) to read .properties resources from the application classpath, disclosing sensitive configuration data. Fixed in 26.9.1.