CVE-2026-75843 ArcadeData CVE debrief

Who should care

Users of ArcadeDB versions before 26.8.1, administrators of systems with ArcadeDB installed, and security teams monitoring for potential JavaScript command execution should be aware of this vulnerability. Operators of affected systems must assess their exposure and take steps to mitigate potential risks. Vulnerability management and security teams should prioritize verification of deployments, application of patches, and monitoring for suspicious activities related to gRPC transaction execution and JavaScript command execution.

Technical summary

ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run unrestricted JavaScript that creates server-wide administrator accounts. This issue arises from inadequate access controls on gRPC transaction execution, enabling unauthorized JavaScript execution with elevated privileges.

Defensive priority

Authenticated readers can execute unrestricted JavaScript commands, creating server-wide administrator accounts.

Recommended defensive actions

• Inventory and verify ArcadeDB versions, checking for 26.8.1 or later.
• Restrict gRPC transaction executor access to authenticated administrators.
• Implement scripting authorization checks for JavaScript execution.
• Monitor for suspicious JavaScript command execution.
• Apply vendor remediation when available.

Evidence notes

The CVE-2026-75843 record indicates ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. This issue enables attackers to execute executeCommand with a transaction ID to run unrestricted JavaScript that creates server-wide administrator accounts. Evidence is limited to CVE and NVD details, which may not cover all affected deployments or configurations. Defenders should verify their deployments against official vendor guidance and assess potential exposure based on their specific use cases and configurations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.