Threats affecting pkg:maven/arcadedb

ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDB, or Redis wire-protocol connections. Attackers holding an existing connection can keep reading and writing data after deletion, grant removal, or password rotation, because executors keep a stale ServerSecurityUser.

ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only query endpoint. Attackers can send a GraphQL type definition with a crafted @sql directive to /api/v1/query/{database}, altering query results returned to other users including administrators.

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then issue LOAD CSV requests to read cloud metadata and internal loopback or private services.

ArcadeDB versions prior to 26.10.1 contain a remote code execution vulnerability due to improper authorization checks in the GremlinQueryEngine.command() method. Authenticated users, including those with read-only reader roles, can execute Groovy code via the POST /api/v1/command/{database} endpoint if the Groovy engine is enabled. This allows execution of OS commands with the privileges of the server process user. The vulnerability is fixed in version 26.10.1.

ArcadeDB versions from 26.2.1 up to but not including 26.10.1 have a missing authorization vulnerability in the Bolt protocol handler. Authenticated users with credentials for one database can exploit this flaw to read schema metadata of other databases by manipulating the db field in RUN or BEGIN messages. This allows unauthorized enumeration of schemas via commands like db.labels() or SHOW INDEXES. The vulnerability is fixed in version 26.10.1.

ArcadeDB versions from 26.2.1 up to but not including 26.10.1 have a missing authorization vulnerability in the Bolt protocol handler. This flaw allows authenticated users with access to any single database to enumerate all database names by issuing a SHOW DATABASES query over the Bolt port. This exposure can reveal unauthorized database names, potentially disclosing tenant or project identifiers. The vulnerability has a medium severity rating and is fixed in version 26.10.1.

ArcadeDB versions from 26.8.1 up to but not including 26.10.1 have an authorization bypass vulnerability. This flaw allows read-only users to modify edge type schema flags related to lightweight and unique settings without having UPDATE_SCHEMA permissions. Attackers can exploit this by sending an ALTER TYPE command via HTTP, gRPC, or Bolt APIs to persistently change edge storage declarations. The vulnerability is fixed in version 26.10.1.

ArcadeDB versions prior to 26.8.1 contain a high-severity arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforcement. The vulnerability arises because unescaped regular expressions are used to validate package names, allowing attackers with trigger creation privileges to exploit Java.type() to access Java classes that can read arbitrary files on the host system.