Vulnerability · Published Sep 15, 2026 · Assigned by GitHub_M
CVE-2026-65831ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read
High 7.7
In plain English
A high-severity privilege mismanagement in arcadedb from ArcadeData. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-role user can submit POST /api/v1/command/{database} with language: js because PolyglotQueryEngine.command, PolyglotQueryEngine.analyze, and PolyglotQueryEngine.registerFunctions do not enforce database-administrator authorization. GraalPolyglotEngine also permits scripts to bypass the allowedPackages whitelist by reflecting from the bound database object through database.getClass().getClassLoader().loadClass to arbitrary host classes. These cooperating defects allow a read-only database user to read arbitrary host files outside the database scope. Process creation is already blocked, so OS command execution is not confirmed. The issue is distinct from CVE-2026-44221, CVE-2026-54076, and CVE-2026-54077. This issue is fixed in version 26.7.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | com.arcadedb:arcadedb-server | 26.7.1 | GHSA-48qw-824m-86pr |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ArcadeData | arcadedb | < 26.7.1 |
| com.arcadedb | arcadedb-server | < 26.7.1 |
Weakness: CWE-269, CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N