These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-76224 debrief based on the supplied source corpus. The vulnerability is a remote code execution issue in ArcadeDB's Gremlin query engine, which falls back to an insecure Groovy engine under certain conditions. This allows an authenticated user with any database role to execute arbitrary operating system commands as the ArcadeDB server process user. Defenders should assess exposure and apply patch [truncated]
A vulnerability in ArcadeDB versions 26.7.3 and earlier allows a user with database access to add or overwrite SQL or Cypher functions in an existing library, enabling tampering with admin-defined function logic. The issue is fixed in version 26.8.1. This vulnerability could allow unauthorized changes to database operations, potentially leading to data manipulation or disruption of database functionality. [truncated]
ArcadeDB versions before 26.8.1 have a vulnerability in the POST /api/v1/server endpoint's create database and drop database commands. This allows authenticated root users to write and delete arbitrary files outside the configured database directory by supplying database names containing ../ sequences. The vulnerability can lead to potential unauthorized file creation and deletion, disrupting server proce [truncated]
A critical vulnerability exists in ArcadeDB versions before 26.8.1, affecting the Redis wire-protocol plugin. This plugin lacks authentication, allowing unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without providing credentials, effectively bypassing all security gates.
ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 has an authorization bypass vulnerability. The plugin enforces authentication (SASL PLAIN) but does not perform authorization, allowing any valid server credential to read, write, and drop data in any database on the server. This issue allows attackers to bypass existing ACLs, including per-type, read-only, and U [truncated]
ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. This vulnerability allows unauthenticated attackers to issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials. Affected systems include those with ArcadeDB installed, particularly those with exposed MongoDB wire-prot [truncated]
CVE-2026-75850 debrief: ArcadeDB before 26.8.1 fails to bind authenticated principals on batch and time-series HTTP handlers, allowing users with limited per-type permissions to read and write to unauthorized types. This vulnerability affects deployments using per-type or per-group ACLs, particularly those with users having limited permissions. Defenders and administrators should assess exposure and prior [truncated]
A missing authorization vulnerability in ArcadeDB before 26.8.1 allows any user with database access to permanently remove registered server-side functions via the command API, impacting integrity and availability. This vulnerability affects the DELETE FUNCTION SQL statement in ArcadeDB, allowing unauthorized deletion of server-side functions. The impact includes potential permanent removal of security-re [truncated]
CVE-2026-75845 is an authorization bypass vulnerability in ArcadeDB versions 26.4.2 through 26.7.3. The issue allows any authenticated read-only user to modify server GlobalConfiguration via the set_server_setting MCP server-level tool, potentially enabling configuration tampering or denial of service. The vulnerability is fixed in version 26.8.1. This issue affects MCP deployments with allowAdmin=true an [truncated]
The CVE-2026-75844 vulnerability affects ArcadeDB versions before 26.8.1, specifically in the IMPORT DATABASE command, allowing for server-side request forgery attacks. Authenticated attackers can bypass security validators to access sensitive endpoints or read local files. Users should exercise caution and consider multiple sources when assessing their risk and developing mitigation strategies. To furthe [truncated]
ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run unrestricted JavaScript that creates server-wide administrator accounts. This issue arises from inadequate access [truncated]
CVE-2026-75842 is a high-severity vulnerability in ArcadeDB that allows authenticated users to read arbitrary files using the OpenCypher LOAD CSV FROM clause. This vulnerability affects ArcadeDB versions before 26.8.1 and can be exploited by users with read query privileges. The vulnerability enables attackers to access local files with server process privileges, potentially leading to sensitive data exfi [truncated]
CVE-2026-75841 debrief based on the supplied source corpus. The CVE record was published on 2026-08-18T12:19:34.463Z. This medium-severity denial-of-service vulnerability in ArcadeDB before 26.8.1 allows authenticated users to exhaust server heap memory via oversized range() expressions in the Cypher range() function, potentially causing temporary service degradation or unavailability. Defenders should as [truncated]
ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforcement. This vulnerability allows attackers with trigger creation privileges to access java.util.zip.ZipFile or java.util.jar.JarFile classes and read arbitrary files on the host system as the ArcadeDB server process. The vulnerability is caused by unescaped regular expressions used to val [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-18T12:19:34.180Z and has not been modified since then. The CVE-2026-75839 vulnerability affects ArcadeDB versions <= 26.7.3 and allows authenticated users to enumerate the full server database registry and retrieve per-database metadata due to an insecure direct object reference (IDOR) vulnerability [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-02T13:16:53.657Z and has not been modified since then. The vulnerability, CVE-2026-68578, affects ArcadeDB versions before 26.7.3. It is caused by the failure to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. This allows n [truncated]
The CVE-2026-67357 vulnerability is an information disclosure issue in the MCP get_server_settings tool of ArcadeDB versions before 26.7.3. This vulnerability allows attackers with MCP access to retrieve the arcadedb.ha.clusterToken in cleartext, which can be used with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate root and achieve full server compromise. Users of ArcadeDB v [truncated]
ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations. An authenticated user with only read access can submit these ALTER TYPE statements via the HTTP command endpoint to mutate a type's custom schema metadata and bucket-selection strategy, bypassing the documented updateSchema permission boundar [truncated]
ArcadeDB versions before 26.7.2 have a vulnerability where the cluster token is not properly redacted in the GET /api/v1/server endpoint. This allows authenticated users to retrieve the arcadedb.ha.clusterToken value in cleartext. The leaked token can be used with specific headers to impersonate root and execute administrative actions. Affected systems may face potential elevation of privileges, unauthori [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-01T13:17:05.417Z and has not been modified since then. The authorization bypass vulnerability in ArcadeDB versions before 26.7.2 could allow attackers to access and modify databases they are not authorized to use. This vulnerability is considered critical, with a CVSS score of 9.3. Organizations usi [truncated]
ArcadeDB versions before 26.7.2 are vulnerable to an authorization bypass due to a failure in enforcing scripting authorization checks on SQL DEFINE FUNCTION statements with LANGUAGE js. This allows attackers with database access to execute arbitrary JavaScript code, potentially leading to unauthorized code execution and data breaches. The CVE record was published on 2026-08-01T13:17:05.273Z and has not b [truncated]
ArcadeDB before 26.7.2 has a vulnerability allowing trigger scripts to look up host classes in java.lang.* via Java.type. An authenticated user with UPDATE_SCHEMA permission can create a JavaScript trigger that invokes java.lang.Runtime.getRuntime().exec() or ProcessBuilder, achieving OS command execution when the trigger fires. This vulnerability allows for potential code execution on affected systems. U [truncated]
Authenticated users and API tokens with database-specific scope in ArcadeDB Multi-Model DBMS, version 21.10.1 to 26.4.1, could bypass authorization to read, write, and mutate schema across databases on the same server due to two defects: (1) uninitialized fileAccessMap in ServerSecurityUser.getDatabaseUser() treated as allow-all by requestAccessOnFile; (2) createDatabase() via POST /api/v1/server omitted [truncated]