CVE-2026-93598 Details
Description
ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 contains an incomplete deny-list in the polyglot script sandbox: com.arcadedb.query.polyglot.HostClassLookupFilter.DENIED lists java.util.ResourceBundle as a bare class name, which is matched by exact equality and therefore does not cover its subclasses, while ScriptTriggerExecutor.ALLOWED_PACKAGES permits java.util.*. A user with the UPDATE_SCHEMA privilege (sufficient to create or alter a JavaScript trigger; no server-admin rights required) can reference java.util.PropertyResourceBundle or java.util.ListResourceBundle and invoke the inherited static ResourceBundle.getBundle(String) to read .properties resources from the application classpath, which the sandbox (IOAccess.NONE, with java.io.**, java.nio.** and java.net.** denied) is intended to make unreachable. This can disclose packaged application configuration such as database credentials and API keys; the advisory states the issue does not provide arbitrary host filesystem read or remote code execution. Fixed in 26.9.1.
A vulnerability exists in ArcadeDB versions through 26.8.1, specifically in the polyglot script sandbox of the ArcadeDB engine. The issue arises from an incomplete deny-list that fails to account for subclasses of 'java.util.ResourceBundle'. While the deny-list explicitly blocks 'ResourceBundle' as a bare class name, it does not cover its public subclasses, 'PropertyResourceBundle' and 'ListResourceBundle', which are allowed by the script execution environment. This oversight enables users with the 'UPDATE_SCHEMA' privilege to access sensitive application configuration data, such as database credentials and API keys, by invoking the 'ResourceBundle.getBundle(String)' method to read .properties files from the application classpath. The sandbox is designed to prevent such access, creating a significant security risk.
Users can upgrade to ArcadeDB version 26.9.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-j57p-qmrh-v7xv | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-j57p-qmrh-v7xv | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/arcadedb-before-26.9.1-classpath-credential-disclosure-via-resourcebundle | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-184 | Incomplete List of Disallowed Inputs | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ArcadeDB | <= 26.8.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2026 | New CVE Received | [email protected] |