{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-75844/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-75843"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ArcadeDB"],"_cs_severities":["critical"],"_cs_tags":["privilege-escalation","database-security","cve-2026-75843","vulnerability","authentication-bypass","arbitrary-file-read","sandbox-bypass","cve-2026-75840","webserver","ssrf","cve-2026-75844"],"_cs_type":"advisory","_cs_vendors":["ArcadeData"],"content_html":"\u003cp\u003eArcadeDB versions prior to 26.8.1 contain a critical security vulnerability (CVE-2026-75843) stemming from improper privilege management within the gRPC transaction executor thread. The issue occurs specifically during the 'beginTransaction' method, where the application fails to bind the authenticated principal to the executor thread.\u003c/p\u003e\n\u003cp\u003eThis failure allows an attacker possessing only read-level authentication to bypass security checks intended to restrict scripting actions. By invoking the 'executeCommand' method and supplying a valid transaction ID, an attacker can execute unrestricted JavaScript on the server. This primitive can be leveraged to manipulate the database configuration, modify security settings, or programmatically create new administrative accounts, resulting in full server compromise. The vulnerability is considered highly critical due to the ease of exploitation by existing users to achieve total administrative control.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker establishes a connection to the target ArcadeDB instance using valid low-privileged reader credentials.\u003c/li\u003e\n\u003cli\u003eAttacker initiates a gRPC session targeting the transaction executor service.\u003c/li\u003e\n\u003cli\u003eAttacker triggers the vulnerable 'beginTransaction' call to establish a transaction context.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious JavaScript payload designed to create a new administrative user.\u003c/li\u003e\n\u003cli\u003eAttacker calls the 'executeCommand' function within the established transaction, passing the malicious JavaScript as an argument.\u003c/li\u003e\n\u003cli\u003eThe server-side thread, having failed to bind the security principal, processes the 'executeCommand' request without authorization checks.\u003c/li\u003e\n\u003cli\u003eThe arbitrary JavaScript executes with elevated privileges on the database server.\u003c/li\u003e\n\u003cli\u003eA new administrative account is created, providing the attacker with persistent, full-access administrative control.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-75843 grants an authenticated attacker complete administrative access to the ArcadeDB instance. This can lead to the total loss of data confidentiality, integrity, and availability. Attackers can exfiltrate sensitive database contents, modify records, or deploy persistent backdoors within the database environment. Organizations running versions of ArcadeDB earlier than 26.8.1 are at significant risk of total server takeover by any compromised user account.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all instances of ArcadeDB to version 26.8.1 or later immediately to patch CVE-2026-75843.\u003c/li\u003e\n\u003cli\u003eAudit logs for unauthorized account creation activity or suspicious JavaScript execution patterns, particularly those originating from existing low-privileged accounts.\u003c/li\u003e\n\u003cli\u003eRestrict network access to the gRPC interface of the database to trusted internal segments to prevent unauthorized connection attempts.\u003c/li\u003e\n\u003cli\u003eRotate credentials for all existing accounts, as attackers may have already leveraged this vulnerability to create hidden administrative backdoors.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-18T12:54:18Z","date_published":"2026-08-18T12:51:42Z","id":"https://feed.craftedsignal.io/briefs/2026-08-arcadedb-privesc/","summary":"ArcadeDB versions before 26.8.1 contain a vulnerability in the gRPC transaction executor that allows authenticated readers to execute arbitrary JavaScript, leading to server-wide privilege escalation.","title":"Authentication Bypass and Privilege Escalation in ArcadeDB","url":"https://feed.craftedsignal.io/briefs/2026-08-arcadedb-privesc/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-75844","version":"https://jsonfeed.org/version/1.1"}