Critical ArcadeDB Authorization Flaw Found

ArcadeDB versions prior to 26.7.2 are vulnerable to a critical authorization bypass flaw identified as CVE-2026-67342. This security vulnerability allows remote, unauthenticated attackers to interact with and modify database contents by targeting specific HTTP handlers, bypassing necessary access controls.

What's at Risk

The vulnerability affects users running ArcadeDB versions earlier than 26.7.2. The flaw exists within the HTTP handlers responsible for time series, batch, Prometheus, and Grafana endpoints. Organizations that have deployed these versions, particularly those with internet-facing database interfaces, are at the highest risk of unauthorized data access and manipulation.

Because the vulnerability does not require authentication, any entity capable of reaching these endpoints over a network can potentially exploit the system. This exposes sensitive data stored within the database and allows for unauthorized changes to the database state, which could lead to data loss or integrity compromise.

How the Flaw Works

This vulnerability is classified as an authorization bypass. In general terms, this class of weakness occurs when an application fails to properly verify the identity or permissions of a user before granting access to sensitive functions or data. When an interface—such as an API endpoint—is designed to perform administrative or data-modifying tasks, it must strictly enforce access control checks for every request.

When these checks are missing or improperly implemented, an attacker can directly invoke these endpoints with arbitrary parameters. By doing so, the application may incorrectly assume the request is legitimate and process it with full privileges, even if the requestor has not provided valid credentials. This type of flaw typically allows unauthorized parties to bypass the security perimeter, enabling them to read, write, or delete data that should be protected by authentication mechanisms.

How to Protect Your Systems

• Upgrade your ArcadeDB deployment to version 26.7.2 or later immediately to resolve the vulnerability.
• Restrict network access to your database management endpoints by using firewalls or VPNs to ensure they are not exposed to the public internet.
• Implement network segmentation to isolate database servers from external-facing application tiers.
• Continuously monitor server logs for unauthorized access attempts or suspicious activity targeting your database management interfaces.
• Follow vendor-provided hardening guides to ensure that all default security configurations are active and properly tuned.

With a CVSS 3.1 score of 9.8, this vulnerability is categorized as critical, reflecting the ease of exploitation and the significant potential impact on data confidentiality, integrity, and availability. Given the nature of the flaw, applying the vendor-supplied patch is the most effective way to secure your environment. Organizations relying on ArcadeDB should prioritize this update to prevent potential unauthorized access and ensure the long-term security of their database infrastructure.