https://feed.craftedsignal.io/products/arcadedb-engine--26.6.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 16 Jul 2026 20:07:35 +0000https://feed.craftedsignal.io/briefs/2026-07-arcadedb-ssrf-file-read/Thu, 16 Jul 2026 20:07:35 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-arcadedb-ssrf-file-read/Authenticated users can exploit an unvalidated `IMPORT DATABASE` function in ArcadeDB (CVE-2026-54077) to perform Server-Side Request Forgery (CWE-918) against cloud metadata endpoints and internal services, or achieve arbitrary local file read (CWE-22) via `file://` paths, exposing sensitive data.A high-severity vulnerability (CVE-2026-54077) in ArcadeDB versions prior to 26.6.1 allows authenticated users to perform Server-Side Request Forgery (SSRF) and arbitrary local file reads. The flaw exists in the IMPORT DATABASE SQL statement, which did not require administrative privileges and failed to validate the source URL provided to its importer. This allows any authenticated user with SQL command access, not just root or administrators, to force the ArcadeDB server to make HTTP(S) requests to arbitrary internal and external destinations, including cloud metadata endpoints (e.g., 169.254.169.254). Attackers can also leverage file:// paths to read sensitive local files, such as /etc/passwd or credential files, which are then ingested as queryable database records. The issue is critical as it enables information disclosure, internal network reconnaissance, and potential lateral movement from a compromised authenticated user account within an ArcadeDB deployment.

Attack Chain

1. An authenticated user with SQL command access connects to the ArcadeDB server's SQL command/query endpoints (/api/v1/command, /api/v1/query).
2. The user crafts and executes an IMPORT DATABASE SQL statement specifying a target URL or file path.
3. To achieve Server-Side Request Forgery (SSRF), the user provides an HTTP(S) URL pointing to an internal service or a cloud metadata endpoint (e.g., http://169.254.169.254/latest/meta-data/).
4. The ArcadeDB server executes the IMPORT DATABASE statement, making an unvalidated outbound HTTP(S) request to the specified URL.
5. The server ingests the HTTP response content from the internal service or cloud metadata endpoint into a database record, allowing the attacker to query the retrieved information.
6. Alternatively, to achieve arbitrary local file read, the user provides a file:// path to a sensitive system file (e.g., file:///etc/passwd, /etc/shadow, or credential files).
7. The ArcadeDB server executes the IMPORT DATABASE statement, attempting to read the local file without proper path validation.
8. The server ingests the file's content into a database record, enabling the authenticated attacker to retrieve and view the sensitive data.

Impact

Successful exploitation of CVE-2026-54077 allows authenticated users to bypass security controls, gaining unauthorized access to internal network resources and sensitive local files residing on the ArcadeDB server. This can lead to significant information disclosure, including cloud instance metadata, internal service configurations, and system-level credentials. Any organization using vulnerable versions of ArcadeDB is at risk, particularly if untrusted users have SQL query access or if the server is deployed in an environment with access to sensitive internal networks or cloud APIs. The consequences of this data exposure could include unauthorized data exfiltration, lateral movement within the network, or further exploitation of exposed internal services.

Recommendation

• Patch CVE-2026-54077 by upgrading ArcadeDB to version 26.6.1 or later immediately.
• Restrict SQL command/query access in ArcadeDB to only trusted administrative users, as specified in the workarounds section of the advisory.
• Deploy the provided Sigma rules to your SIEM and tune them for your environment, especially regarding the specific process identity of your ArcadeDB instance, to detect suspicious network connections and file access.

]]>highadvisoryarcadedbssrffile-readcvedatabasehttps://feed.craftedsignal.io/briefs/2026-05-arcadedb-auth-bypass/Tue, 05 May 2026 22:22:22 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-05-arcadedb-auth-bypass/ArcadeDB versions prior to 26.4.2 are vulnerable to an authorization bypass, allowing authenticated users and API tokens scoped to a specific database to read, write, and mutate schema on any other database on the same server, and disabling the record-level authorization system for newly created databases.ArcadeDB, a multi-model database, is susceptible to an authorization bypass vulnerability affecting versions prior to 26.4.2. This vulnerability stems from two distinct defects: first, the ServerSecurityUser.getDatabaseUser() method returns a database user with an uninitialized file access map, which is then incorrectly interpreted as allowing all access. Second, the ArcadeDBServer.createDatabase() method omits the factory.setSecurity(...) call, effectively disabling the record-level authorization system for any database created via the API endpoint POST /api/v1/server {"command":"create database X"}. This combination of flaws allows authenticated principals to bypass both record-level and database-level authorization constraints.

Attack Chain

1. An attacker authenticates to the ArcadeDB server with valid credentials for a specific database.
2. The attacker leverages the ServerSecurityUser.getDatabaseUser() flaw to gain unauthorized access to other databases.
3. The attacker exploits the uninitialized fileAccessMap vulnerability, allowing them to bypass file access checks.
4. The attacker crafts a request to read data from a database they should not have access to, such as GET /api/v1/database/OtherDatabase/query/sql/SELECT%20*%20FROM%20SomeTable.
5. The server incorrectly authorizes the request due to the flawed access control mechanisms.
6. The attacker then attempts to modify the schema of another database using API calls that would normally be restricted based on database-level permissions. For example, POST /api/v1/database/OtherDatabase {"command":"alter database X"}.
7. If an attacker creates a new database using POST /api/v1/server {"command":"create database X"}, the record-level authorization system is disabled due to the missing factory.setSecurity(...) call.
8. The attacker then exploits the newly created database, which has no security checks, gaining complete control over its data and schema.

Impact

Successful exploitation of this vulnerability allows unauthorized access to sensitive data stored in other databases within the same ArcadeDB server. An attacker can read, write, and modify data across multiple databases, leading to potential data breaches, data corruption, and complete system compromise. Organizations using affected versions of ArcadeDB are at risk of significant data loss and reputational damage. The vulnerability affects all deployments using versions prior to 26.4.2.

Recommendation

• Upgrade ArcadeDB server to version 26.4.2 to patch CVE-2026-44221 and resolve the authorization bypass vulnerability.
• Monitor web server logs for unusual API requests targeting multiple databases from a single authenticated user to detect potential exploitation attempts, and deploy the provided Sigma rule Detect ArcadeDB Database Access from Different IPs to detect this activity.
• Implement rate limiting on API endpoints to mitigate potential brute-force attacks aimed at exploiting this vulnerability and use Detect ArcadeDB Unsecured Database Creation Sigma rule to detect unauthorized database creation.

]]>criticaladvisoryauthorization bypassprivilege escalationcve-2026-44221