A critical authorization flaw in ArcadeDB before 26.7.2 allows callers that can submit SQL to the database to execute arbitrary JavaScript by abusing the DEFINE FUNCTION statement.
What Is It
CVE-2026-67341 is an authorization bypass (CWE-863) in ArcadeDB. Versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement when used with LANGUAGE js. Scripting is intended to be restricted to administrators, but the missing check means that anyone able to submit a DEFINE FUNCTION statement can execute arbitrary JavaScript code, bypassing the security controls meant to gate that capability.
The published record does not state what level of authentication, if any, is required to reach the vulnerable statement handler; NVD's CVSS vector scores it PR:N (no privileges required), while the description frames the defect as a missing scripting-privilege check. Treat the exact prerequisite as unresolved until the maintainers clarify it.
The issue was disclosed via VulnCheck and published to NVD on 2026-08-01. The CVE record is currently in "Received" status.
Why It Matters
NVD carries a CVSS 3.1 base score of 9.8 (CRITICAL): vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That means network-reachable, low attack complexity, no privileges and no user interaction required, with high impact to confidentiality, integrity, and availability. A secondary CVSS 4.0 score of 9.3 (CRITICAL) is also assigned. Note that the PR:N component reflects NVD's scoring of an unanalyzed record and should be read alongside the unresolved authentication prerequisite above.
Arbitrary JavaScript execution inside the database process is effectively code execution on the host in most deployments; not just data disclosure. Any ArcadeDB instance reachable from an untrusted network should be treated as high priority.
CVE-2026-67341 does not appear in the CISA Known Exploited Vulnerabilities catalog as of publication (see Sources for the catalog link to re-check). No evidence of active exploitation is present in the data reviewed here, and exploit maturity in the CVSS 4.0 vector is NOT_DEFINED.
What's Vulnerable
- Vendor: ArcadeData
- Product: ArcadeDB (
pkg:maven/com.arcadedb/arcadedb-engine) - Affected: all versions before 26.7.2, per the version ranges in the NVD record
- Unaffected: 26.7.2 and later, per the same record
No CPE entries were published with the record at time of writing. Version data in a "Received"-status CVE has not yet been through NVD analysis, so confirm against the GitHub Security Advisory and the ArcadeDB release notes before scoping an upgrade.
Patch Status
The NVD record and the GitHub Security Advisory list 26.7.2 as the first unaffected release; upgrade to 26.7.2 or later. This brief has not independently verified the fix commit or release contents; confirm via the advisory below. No CISA-mandated remediation deadline applies, as the CVE is not currently in the KEV catalog.
Sources
- NVD, CVE-2026-67341: https://nvd.nist.gov/vuln/detail/CVE-2026-67341
- ArcadeDB GitHub Security Advisory (GHSA-vwjc-v7x7-cm6g): https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-vwjc-v7x7-cm6g
- VulnCheck Advisory: https://www.vulncheck.com/advisories/arcadedb-before-authorization-bypass-via-sql-define-function
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog