Vendor
SSRF Vulnerability in ArcadeDB via IPv6 Transition Addressing
2 TTPs 1 CVEAuthenticated attackers can exploit a validation flaw in ArcadeDB's SSRF guard to reach internal services or cloud metadata endpoints by using specifically crafted IPv6 transition addresses.
Authentication Bypass and Privilege Escalation in ArcadeDB
1 rule 5 TTPs 1 CVEArcadeDB versions before 26.8.1 contain a vulnerability in the gRPC transaction executor that allows authenticated readers to execute arbitrary JavaScript, leading to server-wide privilege escalation.
ArcadeDB Privilege Escalation via JavaScript Triggers
1 rule 3 TTPs 1 CVEArcadeDB versions before 26.7.3 insecurely expose the LocalDatabase object to JavaScript triggers, allowing attackers with schema update permissions to perform unauthorized administrative actions.
Remote Code Execution in ArcadeDB via Script Triggers
1 TTP 1 CVE 1 IOCAn authenticated remote code execution vulnerability (CVE-2026-67340) in ArcadeDB engine versions before 26.7.2 allows attackers to escape script sandboxing and execute arbitrary OS commands.
ArcadeDB IMPORT DATABASE Allows SSRF and Arbitrary Local File Read
2 rules 3 TTPsAuthenticated users can exploit an unvalidated `IMPORT DATABASE` function in ArcadeDB (CVE-2026-54077) to perform Server-Side Request Forgery (CWE-918) against cloud metadata endpoints and internal services, or achieve arbitrary local file read (CWE-22) via `file://` paths, exposing sensitive data.
ArcadeDB Authorization Bypass Vulnerability
2 rules 2 TTPs 1 CVEArcadeDB versions prior to 26.4.2 are vulnerable to an authorization bypass, allowing authenticated users and API tokens scoped to a specific database to read, write, and mutate schema on any other database on the same server, and disabling the record-level authorization system for newly created databases.