Arcadedata
1 CVEs across 1 Arcadedata products. Browse Arcadedata vulnerabilities, severities, and proof-of-concept exploits.
Arcadedata products with known CVEs
Arcadedata CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-68578 | High | 7.5 | 2026-08-02 | ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no… |
CVE-2026-67357 | High | 7.5 | 2026-08-02 | ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that leaks the arcadedb.ha.clusterToken in… |
CVE-2026-67356 | High | 8.8 | 2026-08-02 | ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins to call getSecurity().c… |
CVE-2026-67344 | Medium | 4.3 | 2026-08-01 | ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL opera… |
CVE-2026-67343 | High | 8.8 | 2026-08-01 | ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing authenticated users to retrieve the arca… |
CVE-2026-67342 | Critical | 9.8 | 2026-08-01 | ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that f… |
CVE-2026-67341 | Critical | 9.8 | 2026-08-01 | ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database a… |
CVE-2026-67340 | Critical | 9.8 | 2026-08-01 | ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java… |
CVE-2026-44221 | Critical | 9.0 | 2026-05-12 | ArcadeDB is a Multi-Model DBMS. Starting in version 21.10.1 and prior to version 26.4.2, authenticated users and API tokens scoped to a specific database could… |