Description

ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run unrestricted JavaScript that creates server-wide administrator accounts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-18T12:19:34.740Z",
  "pubdate": "2026-08-18T12:19:34.740Z",
  "executiveSummary": "ArcadeDB before version 26.8.1 suffers from an authorization bypass vulnerability within its gRPC transaction execution mechanism. The root cause stems from a failure to correctly bind the authenticated principal to the gRPC transaction executor thread during the beginTransaction process. Consequently, authenticated users who possess only read privileges can bypass mandatory scripting authorization checks when interacting with the database via the gRPC interface.\nThe business impact of this vulnerability is critical, as it directly compromises the confidentiality, integrity, and availability of the affected database server. An attacker capable of authenticating as a read-only user can leverage this authorization flaw to execute arbitrary commands, specifically through the executeCommand function combined with a valid transaction ID. This enables the execution of unrestricted JavaScript code directly within the database engine context.\nExploitation requirements are limited to valid reader-level authentication and network access to the gRPC service endpoint. Once exploited, the vulnerability grants attackers the ability to perform high-privilege post-exploitation actions, most notably the creation of server-wide administrator accounts. This leads to complete system compromise and loss of administrative control over the ArcadeDB deployment.",
  "technicalDetails": "The vulnerability resides in the gRPC transaction handling subsystem of ArcadeDB, specifically affecting versions prior to 26.8.1. The vulnerable component fails to enforce security context propagation when transitioning execution threads during the beginTransaction routine. In a secure architecture, the security context containing the authenticated principal and associated role-based permissions must be bound to the worker thread executing the transaction. Because ArcadeDB omits this binding step on the gRPC transaction executor thread, subsequent operations executed within the transaction context lack proper security enforcement.\nAuthentication and privilege requirements for this attack involve possessing valid credentials for an authenticated reader role. While readers are normally restricted from executing write operations or server-side scripting languages, the missing principal binding causes the execution context to evaluate requests without validating scripting authorization checks. The network exposure is tied to the gRPC service port exposed by the ArcadeDB server.\nThe step-by-step attack flow proceeds as follows. First, the authenticated reader establishes a gRPC connection to the ArcadeDB server and initiates a session using standard credentials. Second, the client invokes the beginTransaction function. Due to the implementation flaw, the server fails to bind the reader principal to the resulting transaction executor thread. Third, the attacker obtains the active transaction ID associated with this session. Fourth, the attacker invokes the executeCommand function, passing the transaction ID alongside a malicious payload containing unrestricted JavaScript commands. Finally, because the authorization checks are bypassed due to the unassociated principal context, the ArcadeDB engine executes the arbitrary JavaScript with elevated privileges.\nThe post-exploitation impact is severe. The payload behavior allows attackers to execute administrative operations through the database engine, resulting in the creation of new server-wide administrator accounts. This grants persistent, full administrative access to the underlying ArcadeDB instance, enabling data exfiltration, modification, or complete infrastructure disruption."
}