CVE-2026-44221 ArcadeData CVE debrief

Who should care

System administrators and security teams managing ArcadeDB Multi-Model DBMS installations, especially those with unpatched versions between 21.10.1 and 26.4.1, should prioritize patching to version 26.4.2 or later.

Technical summary

The vulnerability in ArcadeDB arises from two distinct defects: (1) ServerSecurityUser.getDatabaseUser() returns a DB user with an uninitialized fileAccessMap, which requestAccessOnFile treats as allow-all; (2) ArcadeDBServer.createDatabase() omits factory.setSecurity(...), disabling record-level authorization for databases created via POST /api/v1/server. These defects, when combined, allow authenticated users and API tokens scoped to a specific database to bypass record-level and database-level authorization, enabling them to read, write, and mutate schema on any other database on the same server.

Defensive priority

High priority to patch, given the critical severity and potential for widespread exploitation.

Recommended defensive actions

• Patch to version 26.4.2 or later
• Review and restrict database user permissions
• Monitor for suspicious schema modifications
• Inventory and audit affected systems
• Implement compensating controls for database access

Evidence notes

Evidence from official CVE and NVD sources indicates a critical vulnerability in ArcadeDB, with CVSS score of 9.0. The vulnerability allows for unauthorized schema modifications across databases. Evidence limits suggest that further verification is needed to confirm affected scope and severity. Defenders should verify system configurations, review logs for suspicious activity, and ensure patching to version 26.4.2 or later.

Official resources