Arcadedata Arcadedb
42 CVEs affecting Arcadedata Arcadedb. Latest disclosed: 2026-10-30. Critical: 7, High: 21.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-75851 | Critical | 9.9 | 2026-08-18 | ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker thr… |
CVE-2026-75843 | Critical | 9.9 | 2026-08-18 | ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to… |
CVE-2026-75854 | Critical | 9.8 | 2026-08-18 | ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read… |
CVE-2026-75852 | Critical | 9.8 | 2026-08-18 | ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue i… |
CVE-2026-67342 | Critical | 9.8 | 2026-08-01 | ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that f… |
CVE-2026-67341 | Critical | 9.8 | 2026-08-01 | ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database a… |
CVE-2026-44221 | Critical | 9.0 | 2026-05-12 | ArcadeDB is a Multi-Model DBMS. Starting in version 21.10.1 and prior to version 26.4.2, authenticated users and API tokens scoped to a specific database could… |
CVE-2026-76224 | High | 8.8 | 2026-08-19 | ArcadeDB before 26.8.1 (arcadedb-gremlin, affected <= 26.7.3) contains a remote code execution vulnerability in its Gremlin query engine. Although the engine d… |
CVE-2026-75853 | High | 8.8 | 2026-08-18 | ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 enforces authentication (SASL PLAIN) but performs no authorizatio… |
CVE-2026-67356 | High | 8.8 | 2026-08-02 | ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins to call getSecurity().c… |
CVE-2026-67343 | High | 8.8 | 2026-08-01 | ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing authenticated users to retrieve the arca… |
CVE-2026-75855 | High | 8.7 | 2026-08-18 | ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing auth… |
CVE-2026-93594 | High | 8.1 | 2026-09-18 | ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 enforces its per-type/per-record access-control rules only in LocalBucket, keyed on file… |
CVE-2026-93593 | High | 8.1 | 2026-09-18 | ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver builds permissions from bucket IDs, but… |
CVE-2026-54076 | High | 8.1 | 2026-09-15 | ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATE_SCHEMA authorization check only to LocalDocumentType.createProperty… |
CVE-2026-93597 | High | 7.7 | 2026-09-18 | ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attacke… |
CVE-2026-65831 | High | 7.7 | 2026-09-15 | ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-role user can submit POST /api/v1/command/{database} with language: js because PolyglotQueryEngine.co… |
CVE-2026-76225 | High | 7.7 | 2026-08-19 | ArcadeDB before 26.8.1 contains a server-side request forgery vulnerability in the OpenCypher LOAD CSV implementation that fails to validate HTTP/HTTPS URLs. A… |
CVE-2026-75842 | High | 7.7 | 2026-08-18 | ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read loc… |
CVE-2026-114059 | High | 7.5 | 2026-10-21 | ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Gro… |