CVE-2026-67340 ArcadeData CVE debrief

Who should care

Users of ArcadeDB versions before 26.7.2, especially those with UPDATE_SCHEMA permissions, should verify and update their installations to prevent exploitation. This includes reviewing and restricting UPDATE_SCHEMA permissions, monitoring for suspicious activity, and applying vendor remediation when available. Security teams should prioritize patching and compensating controls for exposed systems.

Technical summary

ArcadeDB before 26.7.2 allows trigger scripts to look up host classes in java.lang.* via Java.type. An authenticated user with UPDATE_SCHEMA permission can create a JavaScript trigger that invokes java.lang.Runtime.getRuntime().exec() or ProcessBuilder, achieving OS command execution when the trigger fires. This vulnerability allows for potential code execution on affected systems. The vulnerability can be mitigated by verifying ArcadeDB versions, restricting UPDATE_SCHEMA permissions, and monitoring for suspicious trigger script activity.

Defensive priority

Authenticated users with UPDATE_SCHEMA permission can exploit this vulnerability to execute OS commands.

Recommended defensive actions

• Inventory and verify ArcadeDB versions, checking for version 26.7.2 or later.
• Restrict UPDATE_SCHEMA permissions to necessary users.
• Monitor for suspicious trigger script activity.
• Implement compensating controls to detect and prevent OS command execution.
• Apply vendor remediation when available.

Evidence notes

The CVE-2026-67340 record indicates that ArcadeDB before version 26.7.2 allows trigger scripts to execute OS commands via Java.type. An authenticated user with UPDATE_SCHEMA permission can create a JavaScript trigger that invokes java.lang.Runtime.getRuntime().exec() to achieve OS command execution when the trigger fires. Evidence is limited to CVE and NVD details. Defenders should verify ArcadeDB versions, restrict UPDATE_SCHEMA permissions, and monitor for suspicious trigger script activity.

Official resources