Critical ArcadeDB Flaw Allows Code Execution

ArcadeDB versions prior to 26.7.2 contain a critical vulnerability, tracked as CVE-2026-67341, that permits unauthorized users to execute arbitrary JavaScript code. By targeting the SQL DEFINE FUNCTION statement with the LANGUAGE js parameter, an attacker can circumvent security controls intended to limit scripting capabilities to administrative users.

What's at Risk

The vulnerability affects all ArcadeDB deployments running versions earlier than 26.7.2. Organizations utilizing this database management system, particularly those with internet-facing or multi-tenant instances, face the highest level of risk. Because the flaw allows for the execution of arbitrary code, any system hosting a vulnerable version of the software is susceptible to full compromise of the database environment.

How the Flaw Works

This vulnerability is classified as an authorization bypass. In general, this class of weakness occurs when a software application fails to verify the identity or permissions of a user before granting access to sensitive functions. When an application allows users to define server-side scripts or functions without proper validation, it creates a path for arbitrary code execution. An attacker can leverage this to run malicious commands with the privileges of the database service, potentially leading to unauthorized data access, modification, or total system takeover. Such flaws are particularly dangerous because they often allow an attacker to move from a standard user context to a state of full administrative control.

How to Protect Your Systems

• Upgrade your ArcadeDB installation to version 26.7.2 or later immediately to resolve the authorization check failure.
• Restrict network access to your database instances by placing them behind a firewall and limiting connections to trusted IP addresses only.
• Audit your database logs for any unauthorized or unusual usage of the DEFINE FUNCTION command.
• Implement the principle of least privilege by ensuring that database users only have the minimum permissions required to perform their specific tasks.
• Regularly review vendor security advisories and maintain a consistent schedule for applying critical security patches to all database infrastructure.

Given the 9.8 CVSS critical rating assigned to CVE-2026-67341, the potential for exploitation is significant. The ability to execute arbitrary code without administrative credentials makes this a high-priority risk that requires immediate attention from system administrators. Promptly applying the vendor-provided patch is the only effective way to eliminate the vulnerability and secure the database against potential unauthorized access.