Authentication Bypass and Privilege Escalation in ArcadeDB

ArcadeDB versions prior to 26.8.1 contain a critical security vulnerability (CVE-2026-75843) stemming from improper privilege management within the gRPC transaction executor thread. The issue occurs specifically during the 'beginTransaction' method, where the application fails to bind the authenticated principal to the executor thread.

This failure allows an attacker possessing only read-level authentication to bypass security checks intended to restrict scripting actions. By invoking the 'executeCommand' method and supplying a valid transaction ID, an attacker can execute unrestricted JavaScript on the server. This primitive can be leveraged to manipulate the database configuration, modify security settings, or programmatically create new administrative accounts, resulting in full server compromise. The vulnerability is considered highly critical due to the ease of exploitation by existing users to achieve total administrative control.

Attack Chain

1. Attacker establishes a connection to the target ArcadeDB instance using valid low-privileged reader credentials.
2. Attacker initiates a gRPC session targeting the transaction executor service.
3. Attacker triggers the vulnerable 'beginTransaction' call to establish a transaction context.
4. Attacker crafts a malicious JavaScript payload designed to create a new administrative user.
5. Attacker calls the 'executeCommand' function within the established transaction, passing the malicious JavaScript as an argument.
6. The server-side thread, having failed to bind the security principal, processes the 'executeCommand' request without authorization checks.
7. The arbitrary JavaScript executes with elevated privileges on the database server.
8. A new administrative account is created, providing the attacker with persistent, full-access administrative control.

Impact

Successful exploitation of CVE-2026-75843 grants an authenticated attacker complete administrative access to the ArcadeDB instance. This can lead to the total loss of data confidentiality, integrity, and availability. Attackers can exfiltrate sensitive database contents, modify records, or deploy persistent backdoors within the database environment. Organizations running versions of ArcadeDB earlier than 26.8.1 are at significant risk of total server takeover by any compromised user account.

Recommendation

• Upgrade all instances of ArcadeDB to version 26.8.1 or later immediately to patch CVE-2026-75843.
• Audit logs for unauthorized account creation activity or suspicious JavaScript execution patterns, particularly those originating from existing low-privileged accounts.
• Restrict network access to the gRPC interface of the database to trusted internal segments to prevent unauthorized connection attempts.
• Rotate credentials for all existing accounts, as attackers may have already leveraged this vulnerability to create hidden administrative backdoors.