A critical authorization bypass in ArcadeDB versions before 26.7.2 lets unauthenticated attackers read and modify databases they have no rights to, simply by naming them in a request to a handful of HTTP endpoints.
What Is It
CVE-2026-67342 is an authorization bypass (CWE-639, insecure direct object reference) in ArcadeDB's HTTP handlers for time series, batch, Prometheus, and Grafana endpoints. Those handlers fail to validate database access permissions. An attacker can call an affected endpoint with an arbitrary database parameter and reach any database on the server, regardless of what they are actually authorized to use.
The flaw carries a CVSS 3.1 base score of 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CVSS 4.0 score assigned by the reporting source is 9.3, also CRITICAL. Both scores describe the same profile: network-reachable, low attack complexity, no privileges, no user interaction, with high impact to confidentiality, integrity, and availability.
Why It Matters
The scoring metrics assign no privileges required and low attack complexity, and the advisory describes the mechanism as supplying a database parameter the caller is not authorized for to an affected endpoint. On the available description, that puts exploitation within reach of anyone who can reach the endpoint over the network, though no public exploit code or proof-of-concept is referenced in the advisory data. Access is not read-only: the record explicitly states attackers can access and modify databases. For a database server, that means tenant isolation on a shared ArcadeDB instance cannot be assumed to hold.
Prometheus and Grafana integration endpoints are frequently left exposed to internal monitoring networks and, in misconfigured deployments, to the internet. Those are precisely the handlers affected.
What's Vulnerable
- Vendor/product: ArcadeData ArcadeDB (
pkg:maven/com.arcadedb/arcadedb-server) - Affected: all versions before 26.7.2
- Fixed: 26.7.2 and later
- Affected components: HTTP handlers for time series, batch, Prometheus, and Grafana endpoints
Patch Status
ArcadeDB 26.7.2 resolves the issue and is the fixed release identified in the advisory data. Upgrade to 26.7.2 or later. As of publication, CVE-2026-67342 does not appear in the CISA Known Exploited Vulnerabilities catalog, so there is no confirmed active exploitation and no federal remediation deadline at this time. The NVD record was published 2026-08-01 and remains in "Received" status, meaning NVD analysis is not yet complete.
Sources
- NVD, CVE-2026-67342: https://nvd.nist.gov/vuln/detail/CVE-2026-67342
- ArcadeData GitHub Security Advisory GHSA-x8mg-6r4p-87pf: https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-x8mg-6r4p-87pf
- VulnCheck Advisory; ArcadeDB Authorization Bypass via Database Handlers: https://www.vulncheck.com/advisories/arcadedb-before-authorization-bypass-via-database-handlers
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog