Authorization Bypass in ArcadeDB SQL DEFINE FUNCTION

ArcadeDB versions prior to 26.7.2 are vulnerable to an authorization bypass flaw, tracked as CVE-2026-67341. The vulnerability exists within the SQL engine's handling of the DEFINE FUNCTION command when the LANGUAGE parameter is set to js. The application fails to properly enforce security checks that should restrict the registration of functions to administrative users. An attacker with database access can leverage this defect to register and execute arbitrary JavaScript code. This vulnerability has a critical impact, potentially allowing for full system compromise or unauthorized access to sensitive database data, as the code executes within the context of the database process.

Attack Chain

1. Attacker establishes a connection to the target ArcadeDB instance.
2. Attacker crafts a malicious SQL DEFINE FUNCTION statement specifying LANGUAGE js.
3. Attacker embeds arbitrary JavaScript payload into the function body.
4. Attacker executes the SQL statement against the target database.
5. The ArcadeDB engine fails to validate the user's authorization level for the DEFINE FUNCTION operation.
6. The database engine registers the malicious function.
7. Attacker invokes the newly created function to execute the malicious JavaScript payload.
8. Attacker achieves command execution within the database engine context.

Impact

Successful exploitation of this vulnerability allows unauthorized users to achieve arbitrary code execution within the database engine. This can lead to full compromise of the database integrity, confidentiality, and availability, depending on the permissions of the database process. The vulnerability affects all ArcadeDB deployments running versions prior to 26.7.2.

Recommendation

• Upgrade all ArcadeDB instances to version 26.7.2 or later immediately to address the authorization check failure.
• Audit database logs for the usage of the DEFINE FUNCTION command, specifically looking for JavaScript-based functions created by non-administrative service accounts.
• Restrict network access to the ArcadeDB management ports to prevent unauthorized actors from reaching the database interface.
• Monitor database activity for unexpected execution of custom functions.