Vulnerabilidades do ArcadeData Arcadedb

CVE-2026-75854 Crítica · 9.8 CWE-306 18/08/2026

ArcadeDB: plugin de protocolo Redis sem autenticação

As versões do ArcadeDB anteriores à 26.8.1 contêm uma vulnerabilidade de falta de autenticação no plugin de protocolo wire Redis que permite a atacantes não autenticados ler, gravar e excluir dados. Atacantes podem conectar-se à porta Redis e executar comandos arbitrários contra qualquer banco de dados do servidor sem fornecer credenciais, contornando todos os mecanismos de segurança.

CVE-2026-68578 Alta · 7.5 CWE-306 02/08/2026

ArcadeDB before 26.7.3 Authentication Bypass via MCP Transport

ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via the query tool.

CVE-2026-67356 Alta · 8.8 CWE-269 02/08/2026

ArcadeDB before 26.7.3 Privilege Escalation via JavaScript Trigger

ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins to call getSecurity().createUser() without permission checks. Attackers with UPDATE_SCHEMA permission can create triggers that execute JavaScript to create server-wide admin users, escalating privileges beyond their authorization level.

CVE-2026-67344 Média · 4.3 CWE-862 01/08/2026

ArcadeDB before 26.7.2 Authentication Bypass via ALTER TYPE

ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access (e.g., a read-only API token) can submit these ALTER TYPE statements via the HTTP command endpoint to mutate a type's custom schema metadata and bucket-selection strategy, bypassing the documented updateSchema permission boundary and potentially corrupting schema metadata and record routing.

CVE-2026-67343 Alta · 8.8 CWE-200 01/08/2026

ArcadeDB before 26.7.2 Cluster Token Disclosure via GET /api/v1/server

ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing authenticated users to retrieve the arcadedb.ha.clusterToken value in cleartext. Attackers can use the leaked token with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate root and execute administrative actions including user creation, database operations, and server shutdown.

CVE-2026-67342 Crítica · 9.8 CWE-639 01/08/2026

ArcadeDB before 26.7.2 Authorization Bypass via Database Handlers

ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling affected endpoints with arbitrary database parameters.

CVE-2026-67341 Crítica · 9.8 CWE-863 01/08/2026

ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTION

ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing security controls intended to restrict scripting to administrators.

CVE-2026-67340 Alta · 7.2 CWE-94 01/08/2026

ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts

ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java.lang.* to the allowed packages. An authenticated user with UPDATE_SCHEMA permission can create a JavaScript trigger that invokes java.lang.Runtime.getRuntime().exec() (or ProcessBuilder), achieving OS command execution when the trigger fires.

CVE-2026-44221 Crítica · 9.0 CWE-863 12/05/2026

ArcadeDB: bypass de autorização entre bancos de dados (CWE-863)

ArcadeDB é um DBMS multimodelo. A partir da versão 21.10.1 e antes da versão 26.4.2, usuários autenticados e tokens de API limitados a um banco de dados específico podiam ler, gravar e alterar o esquema de qualquer outro banco de dados no mesmo servidor. Dois defeitos distintos contribuíram: (1) ServerSecurityUser.getDatabaseUser() retornava um usuário de banco de dados com fileAccessMap não inicializado, que requestAccessOnFile tratava como permissão total; (2) ArcadeDBServer.createDatabase() omitia factory.setSecurity(...), de modo que qualquer banco criado via POST /api/v1/server {"command":"create database X"} tinha todo o seu sistema de autorização em nível de registro silenciosamente desativado. Em combinação, a autorização em nível de registro e em nível de banco de dados podia ser contornada por qualquer principal autenticado. Esta vulnerabilidade foi corrigida na versão 26.4.2.