Description

ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-role user can submit POST /api/v1/command/{database} with language: js because PolyglotQueryEngine.command, PolyglotQueryEngine.analyze, and PolyglotQueryEngine.registerFunctions do not enforce database-administrator authorization. GraalPolyglotEngine also permits scripts to bypass the allowedPackages whitelist by reflecting from the bound database object through database.getClass().getClassLoader().loadClass to arbitrary host classes. These cooperating defects allow a read-only database user to read arbitrary host files outside the database scope. Process creation is already blocked, so OS command execution is not confirmed. The issue is distinct from CVE-2026-44221, CVE-2026-54076, and CVE-2026-54077. This issue is fixed in version 26.7.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-15T16:17:22.387Z",
  "pubdate": "2026-09-15T16:17:22.387Z",
  "executiveSummary": "ArcadeDB versions prior to 26.7.1 are susceptible to an Arbitrary File Read vulnerability caused by insufficient authorization checks and sandbox escapes within the PolyglotQueryEngine.\nThe vulnerability allows an authenticated user with a reader-role to execute arbitrary JavaScript code via the /api/v1/command/{database} endpoint.\nBy leveraging GraalPolyglotEngine reflection, attackers can bypass security whitelists to access host-side Java classes, ultimately leading to unauthorized reading of files outside the database scope.\nThe impact is significant as it permits sensitive data exfiltration from the underlying host filesystem, despite the existing restrictions on process creation.\nThis vulnerability highlights a critical failure in enforcing database-administrator level authorization for sensitive query engine functions.\nImmediate patching to version 26.7.1 is required to remediate these security gaps.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of authorization controls within the PolyglotQueryEngine component of ArcadeDB. Specifically, the methods command, analyze, and registerFunctions fail to validate whether the invoking user possesses database-administrator privileges, permitting non-privileged users to interact with high-sensitivity polyglot engine features.\nThe attack vector involves a POST request to /api/v1/command/{database} utilizing the 'js' language parameter. When processed, the engine allows for the execution of scripts that interact with the bound database object. The GraalPolyglotEngine configuration is insufficiently hardened, enabling an attacker to perform reflective calls. By accessing database.getClass().getClassLoader().loadClass, an attacker can escape the intended sandbox and instantiate arbitrary host classes.\nThe attack flow proceeds as follows: First, the attacker authenticates as a user with the reader-role. Second, the attacker crafts a malicious JavaScript payload designed to reflect on the database's ClassLoader. Third, the attacker calls loadClass to access classes outside the permitted whitelist, effectively bypassing the package restrictions imposed on the Polyglot engine. Fourth, once access to host-side classes is achieved, the attacker can invoke methods or access fields that facilitate arbitrary file system reads, bypassing the intended database-level data isolation.\nWhile the environment prevents OS command execution, the ability to read arbitrary files remains a severe risk, as it allows the retrieval of system configuration files, credentials, or sensitive application-tier data stored on the host. This vulnerability is distinct from other identified issues such as CVE-2026-44221, CVE-2026-54076, and CVE-2026-54077, indicating a complex landscape of potential sandbox escapes within the polyglot integration."
}