Skip to content
Threat Feed
Subscribe

Tag

ArcadeDB

4 briefs RSS
critical advisory

Remote Code Execution in ArcadeDB via Script Triggers

An authenticated remote code execution vulnerability (CVE-2026-67340) in ArcadeDB engine versions before 26.7.2 allows attackers to escape script sandboxing and execute arbitrary OS commands.

PoC arcadedb-engine +1 cve-2026-67340 rce database arcadedb
1t 1c 1i updated
high advisory

ArcadeDB Cross-Database IDOR Vulnerability Allows Unauthorized Data Access

ArcadeDB server versions prior to 26.7.2 are vulnerable to a cross-database Insecure Direct Object Reference (IDOR) due to improper authorization checks in several HTTP handlers, enabling a user authorized for a specific database to gain full read and write access to other unauthorized databases by directly accessing specific API endpoints.

arcadedb-server idor authorization-bypass arcadedb web-application
1r 1t
high advisory

ArcadeDB Trigger Script RCE via Java.lang.* Allow-list

A vulnerability in ArcadeDB's ScriptTriggerExecutor allows users with UPDATE_SCHEMA privileges to achieve OS Remote Code Execution (RCE) due to a permissive allow-list for trigger scripts, enabling direct calls to `java.lang.Runtime.exec()` when a malicious trigger script is created and fired.

arcadedb-engine ArcadeDB RCE vulnerability java database privilege-escalation SSRF DoS +2
3t
high advisory

ArcadeDB IMPORT DATABASE Allows SSRF and Arbitrary Local File Read

Authenticated users can exploit an unvalidated `IMPORT DATABASE` function in ArcadeDB (CVE-2026-54077) to perform Server-Side Request Forgery (CWE-918) against cloud metadata endpoints and internal services, or achieve arbitrary local file read (CWE-22) via `file://` paths, exposing sensitive data.

arcadedb-engine arcadedb ssrf file-read cve database
2r 3t