CVE-2026-65831 Details
Description
ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-role user can submit POST /api/v1/command/{database} with language: js because PolyglotQueryEngine.command, PolyglotQueryEngine.analyze, and PolyglotQueryEngine.registerFunctions do not enforce database-administrator authorization. GraalPolyglotEngine also permits scripts to bypass the allowedPackages whitelist by reflecting from the bound database object through database.getClass().getClassLoader().loadClass to arbitrary host classes. These cooperating defects allow a read-only database user to read arbitrary host files outside the database scope. Process creation is already blocked, so OS command execution is not confirmed. The issue is distinct from CVE-2026-44221, CVE-2026-54076, and CVE-2026-54077. This issue is fixed in version 26.7.1.
A vulnerability in ArcadeDB versions prior to 26.7.1 allows users with reader-role privileges to execute arbitrary JavaScript via the POST /api/v1/command/{database} endpoint. This is possible because the Polyglot Query Engine does not properly enforce database-administrator authorization for script execution. Additionally, the Graal Polyglot Engine's sandbox can be bypassed, allowing scripts to access restricted host classes and read arbitrary files from the host filesystem, such as configuration files, outside the database scope. While process creation and OS command execution are blocked, the vulnerability's impact on confidentiality is considered high due to the potential exposure of sensitive host files.
Users should upgrade to ArcadeDB version 26.7.1 or later, where this vulnerability has been fixed. After upgrading, non-administrator accounts will no longer be able to execute JavaScript or polyglot scripts via the HTTP API.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 15, 2026CISA-ADP
Assessed Sep 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ArcadeData/arcadedb/commit/8ca396c07e471a0b97fee075eeb956b5e24a23be | [email protected] | Source CodeVendor |
| https://github.com/ArcadeData/arcadedb/releases/tag/26.7.1 | [email protected] | Release NotesVendor |
| https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-48qw-824m-86pr | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ArcadeDB | < 26.7.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | New CVE Received | [email protected] |
| Sep 15, 2026 | CVE Modified | CISA-ADP |