CVE-2026-67344 ArcadeData CVE debrief

Who should care

Users of ArcadeDB versions before 26.7.2, security teams monitoring for schema integrity and authentication bypass vulnerabilities, and operators responsible for database management and maintenance should be aware of this vulnerability and take necessary actions to mitigate the risk.

Technical summary

ArcadeDB before 26.7.2 fails to enforce UPDATE_SCHEMA permission on ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations. Authenticated users with read access can submit these statements to mutate schema metadata and bucket-selection strategy, potentially corrupting schema and record routing. This could lead to unauthorized modifications of the database schema, impacting data integrity and security.

Defensive priority

Authenticated users with read-only access can bypass updateSchema permission, potentially corrupting schema metadata and record routing.

Recommended defensive actions

• Verify ArcadeDB version and apply vendor patches
• Restrict access to ALTER TYPE statements
• Monitor for suspicious schema changes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Evidence is limited; verify with official records and vendor remediation. Check inventory for ArcadeDB versions before 26.7.2 and monitor for suspicious ALTER TYPE statements. Ensure thorough validation of user permissions and restrict access to ALTER TYPE statements to prevent unauthorized schema changes.

Official resources