Threat Intelligence Database

ArcadeDB versions before 26.8.1 contain a server-side request forgery (SSRF) vulnerability in the OpenCypher LOAD CSV feature. This flaw allows authenticated attackers to craft queries that cause the server to fetch data from internal network addresses or cloud metadata endpoints, potentially exposing sensitive information. The vulnerability arises because the implementation does not properly validate HTTP/HTTPS URLs in LOAD CSV commands.

ArcadeDB versions before 26.8.1 contain a remote code execution vulnerability in the Gremlin query engine. The vulnerability arises because the ArcadeGremlin.executeStatement() method falls back to an insecure Groovy engine when a query with parameters does not parse as gremlin-lang. This fallback allows an authenticated user with any database role, including read-only, to execute arbitrary operating system commands as the server process user.

ArcadeDB (com.arcadedb) versions 26.7.3 and earlier fail to enforce the UPDATE_SCHEMA permission check when a DEFINE FUNCTION statement targets an already-existing function library. A user with only database access can add or overwrite SQL or Cypher functions in an existing library and persist the change, enabling tampering with admin-defined function logic. The issue is fixed in 26.8.1. (JavaScript functions still trigger the UPDATE_SECURITY check and are not affected.)

ArcadeDB versions prior to 26.8.1 contain a path traversal vulnerability in the POST /api/v1/server endpoint. Authenticated root users can exploit this flaw by supplying crafted database names with '../' sequences, enabling them to create or delete files outside the intended database directory. This allows arbitrary file write and deletion on the filesystem accessible to the server process.

ArcadeDB versions prior to 26.8.1 have a critical vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to perform read, write, and delete operations on any database. This flaw enables attackers to connect to the Redis port and execute arbitrary commands without authentication, bypassing all security controls.

ArcadeDB versions before 26.8.1 have a critical vulnerability where the MongoDB wire-protocol plugin does not enforce SASL authentication on data commands. This allows unauthenticated attackers to perform insert, find, update, delete, and create operations on any database by connecting to port 27017 without credentials.

ArcadeDB versions up to 26.7.3 have a missing authorization vulnerability in the DELETE FUNCTION SQL statement. This flaw allows any user with database access to delete server-side functions without proper permission checks, potentially impacting the database's integrity and availability.

ArcadeDB versions 26.4.2 through 26.7.3 have an authorization bypass vulnerability in the set_server_setting MCP server-level tool. The vulnerability allows any authenticated read-only user to modify server global configuration when the allowAdmin flag is true, due to insufficient role checks. This can lead to configuration tampering or denial of service. The issue is fixed in version 26.8.1.

CVE-2026-75843 is a critical vulnerability in ArcadeData's arcadedb prior to version 26.8.1. The flaw involves improper privilege management where the authenticated principal is not correctly bound on the gRPC transaction executor thread during beginTransaction. This allows authenticated users with reader privileges to bypass scripting authorization checks and execute unrestricted JavaScript commands. Exploitation can lead to creation of server-wide administrator accounts, severely compromising the database server.

ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via the query tool.