Arcadedb - CraftedSignal Threat Feed

ArcadeDB Cross-Database IDOR Vulnerability Allows Unauthorized Data Access

hello@craftedsignal.io — Thu, 16 Jul 2026 20:21:14 +0000

ArcadeDB, an open-source NoSQL graph database, contains a critical Insecure Direct Object Reference (IDOR) vulnerability (GHSA-x8mg-6r4p-87pf) affecting server versions prior to 26.7.2. This flaw allows a user with valid credentials, who is authorized to access only one database, to bypass authorization checks and gain full read and write access to other, unauthorized databases within the same ArcadeDB instance. The vulnerability stems from 14 specific HTTP handlers (including those for batch operations, time-series data, Prometheus, and Grafana integrations) which directly extend AbstractServerHttpHandler instead of the secure DatabaseAbstractHandler, failing to invoke the crucial user.canAccessToDatabase() function. Exploitation of this vulnerability grants attackers unauthorized control over sensitive data across different databases, posing a significant risk of data exfiltration, manipulation, or integrity compromise. This issue directly impacts organizations using ArcadeDB for multi-tenant or segmented data storage.

Attack Chain

Initial Authentication: An attacker obtains valid user credentials for an ArcadeDB instance, successfully authenticating and gaining authorized access to at least one specific database (e.g., 'DB A').
Identify Vulnerable Endpoints: The attacker identifies specific ArcadeDB HTTP API endpoints, such as /api/v1/batch/{db}, /api/v1/ts/{db}/write, or /api/v1/ts/{db}/prom/api/v1/query, which are known to be affected by the IDOR vulnerability.
Craft Malicious HTTP Request: The attacker crafts an HTTP request (GET or POST) targeting one of the identified vulnerable endpoints. Crucially, the attacker substitutes the database identifier in the URL path parameter (e.g., {db}) from their authorized database ('DB A') to an unauthorized target database ('DB B').
Authorization Bypass: Upon receiving the request, the ArcadeDB server's vulnerable HTTP handler (e.g., PostBatchHandler or PostTimeSeriesWriteHandler) processes the {database} path parameter without invoking the necessary user.canAccessToDatabase() authorization check.
Unauthorized Database Access: The server proceeds to resolve and access the target database ('DB B') despite the attacker's lack of explicit authorization for it.
Perform Unauthorized Operations: The attacker successfully executes read (e.g., via /api/v1/ts/b/prom/api/v1/query) or write (e.g., via /api/v1/batch/b or /api/v1/ts/b/write) operations on the unauthorized 'DB B', receiving a "200 OK" HTTP status code.
Data Exfiltration or Manipulation: Through these unauthorized operations, the attacker gains full control over 'DB B', allowing for data exfiltration, modification, or deletion, leading to compromise of data confidentiality and integrity.

Impact

Successful exploitation of this IDOR vulnerability allows an authenticated attacker to bypass authorization controls, gaining complete read and write access to any database within the ArcadeDB instance, regardless of their assigned permissions. This leads to a severe compromise of data confidentiality and integrity across all databases. Attackers can exfiltrate sensitive information, alter critical data, or even delete entire database contents. Organizations utilizing ArcadeDB for multi-tenant environments or to segregate data by user/department are particularly at risk, as an attacker with low-privilege access to one database could escalate their privileges to access all others.

Recommendation

Patch ArcadeDB: Immediately upgrade ArcadeDB server instances to version 26.7.2 or later to apply the necessary security fixes.
Monitor Webserver Logs: Deploy the Sigma rule in this brief to your SIEM and monitor webserver logs for HTTP requests targeting the vulnerable /api/v1/batch/ and /api/v1/ts/ API endpoints.
Review Access Logs: Periodically review webserver access logs for anomalous requests to the /api/v1/batch/{db} and /api/v1/ts/{db}/* paths, particularly for requests to database names that the originating user should not have access to.

ArcadeDB Trigger Script RCE via Java.lang.* Allow-list

hello@craftedsignal.io — Thu, 16 Jul 2026 20:17:00 +0000

A high-severity vulnerability has been identified in ArcadeDB, affecting versions prior to 26.7.2. The ScriptTriggerExecutor component, responsible for executing trigger scripts, includes java.lang.* in its allowed packages. This oversight permits an authenticated attacker with UPDATE_SCHEMA privileges (a schema administrator) to craft and deploy a malicious JavaScript trigger. When such a trigger fires, it can invoke java.lang.Runtime.exec(), leading to arbitrary operating system command execution on the host server where ArcadeDB is running. This effectively escalates privileges from a database schema administrator to remote code execution on the underlying operating system, posing a significant risk to the integrity and confidentiality of the host system and the data stored within ArcadeDB.

Attack Chain

An attacker gains UPDATE_SCHEMA administrative privileges within an ArcadeDB instance.
The attacker crafts a malicious database trigger script that includes an OS command execution payload.
The attacker registers this malicious trigger within ArcadeDB using the CREATE TRIGGER ... EXECUTE JAVASCRIPT command.
The JavaScript payload within the trigger leverages the permissive java.lang.* allow-list to call Java.type("java.lang.Runtime").getRuntime().exec(...).
The crafted trigger is saved into the database schema, awaiting its activation conditions.
A subsequent database operation or event occurs that satisfies the conditions for the newly created malicious trigger to fire.
The ArcadeDB ScriptTriggerExecutor processes the trigger, and due to java.lang.* being in the allow-list, the java.lang.Runtime.exec() call is permitted.
The attacker's specified operating system commands are executed on the host server with the privileges of the ArcadeDB process, achieving remote code execution.

Impact

Successful exploitation of this vulnerability results in arbitrary remote code execution on the server hosting ArcadeDB. This allows an attacker to completely compromise the underlying operating system, potentially leading to data exfiltration, deletion, or modification of any data accessible by the ArcadeDB process. While it requires an attacker to first obtain UPDATE_SCHEMA privileges, the RCE then allows for privilege escalation from a schema administrator role to full system control. The compromise can affect any operating system ArcadeDB is deployed on, including Windows, Linux, and macOS.

Recommendation

Upgrade ArcadeDB installations immediately to version 26.7.2 or later to apply the official patch.
Review and ensure strict access controls are in place for users assigned UPDATE_SCHEMA privileges.
Administrators should monitor database logs for suspicious CREATE TRIGGER statements that include JAVASCRIPT execution.

ArcadeDB IMPORT DATABASE Allows SSRF and Arbitrary Local File Read

hello@craftedsignal.io — Thu, 16 Jul 2026 20:07:35 +0000

A high-severity vulnerability (CVE-2026-54077) in ArcadeDB versions prior to 26.6.1 allows authenticated users to perform Server-Side Request Forgery (SSRF) and arbitrary local file reads. The flaw exists in the IMPORT DATABASE SQL statement, which did not require administrative privileges and failed to validate the source URL provided to its importer. This allows any authenticated user with SQL command access, not just root or administrators, to force the ArcadeDB server to make HTTP(S) requests to arbitrary internal and external destinations, including cloud metadata endpoints (e.g., 169.254.169.254). Attackers can also leverage file:// paths to read sensitive local files, such as /etc/passwd or credential files, which are then ingested as queryable database records. The issue is critical as it enables information disclosure, internal network reconnaissance, and potential lateral movement from a compromised authenticated user account within an ArcadeDB deployment.

Attack Chain

An authenticated user with SQL command access connects to the ArcadeDB server's SQL command/query endpoints (/api/v1/command, /api/v1/query).
The user crafts and executes an IMPORT DATABASE SQL statement specifying a target URL or file path.
To achieve Server-Side Request Forgery (SSRF), the user provides an HTTP(S) URL pointing to an internal service or a cloud metadata endpoint (e.g., http://169.254.169.254/latest/meta-data/).
The ArcadeDB server executes the IMPORT DATABASE statement, making an unvalidated outbound HTTP(S) request to the specified URL.
The server ingests the HTTP response content from the internal service or cloud metadata endpoint into a database record, allowing the attacker to query the retrieved information.
Alternatively, to achieve arbitrary local file read, the user provides a file:// path to a sensitive system file (e.g., file:///etc/passwd, /etc/shadow, or credential files).
The ArcadeDB server executes the IMPORT DATABASE statement, attempting to read the local file without proper path validation.
The server ingests the file's content into a database record, enabling the authenticated attacker to retrieve and view the sensitive data.

Impact

Successful exploitation of CVE-2026-54077 allows authenticated users to bypass security controls, gaining unauthorized access to internal network resources and sensitive local files residing on the ArcadeDB server. This can lead to significant information disclosure, including cloud instance metadata, internal service configurations, and system-level credentials. Any organization using vulnerable versions of ArcadeDB is at risk, particularly if untrusted users have SQL query access or if the server is deployed in an environment with access to sensitive internal networks or cloud APIs. The consequences of this data exposure could include unauthorized data exfiltration, lateral movement within the network, or further exploitation of exposed internal services.

Recommendation

Patch CVE-2026-54077 by upgrading ArcadeDB to version 26.6.1 or later immediately.
Restrict SQL command/query access in ArcadeDB to only trusted administrative users, as specified in the workarounds section of the advisory.
Deploy the provided Sigma rules to your SIEM and tune them for your environment, especially regarding the specific process identity of your ArcadeDB instance, to detect suspicious network connections and file access.