CVE-2026-65831: ArcadeDB Privilege Escalation Vulnerability

CVE-2026-65831 Overview

ArcadeDB, a multi-model database management system, contains an authorization bypass in its polyglot query engine prior to version 26.7.1. A reader-role user can submit POST /api/v1/command/{database} requests with language: js because PolyglotQueryEngine.command, PolyglotQueryEngine.analyze, and PolyglotQueryEngine.registerFunctions do not enforce database-administrator authorization. The GraalPolyglotEngine also permits scripts to bypass the allowedPackages whitelist through reflection. Combined, these defects allow a read-only database user to read arbitrary host files outside the database scope. The vulnerability is tracked under [CWE-269: Improper Privilege Management].

Critical Impact
Read-only ArcadeDB users can escape the polyglot sandbox and read arbitrary files from the host filesystem outside the database scope.

Affected Products

ArcadeDB versions prior to 26.7.1
PolyglotQueryEngine component (command, analyze, registerFunctions methods)
GraalPolyglotEngine component with JavaScript language support

Discovery Timeline

2026-09-15 - CVE CVE-2026-65831 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-65831

Vulnerability Analysis

The vulnerability chains two cooperating defects in ArcadeDB's polyglot scripting subsystem. First, the REST endpoint POST /api/v1/command/{database} accepts a language: js parameter and dispatches to PolyglotQueryEngine without verifying that the caller holds database-administrator privileges. This exposes JavaScript execution to any authenticated reader-role user.

Second, GraalPolyglotEngine enforces a package allowlist through allowedPackages, but the bound database object exposes a reflection surface. A script can invoke database.getClass().getClassLoader().loadClass("java.io.File") to load arbitrary host classes outside the whitelist. This defeats the sandbox and enables arbitrary host file reads. Process creation is already blocked by other controls, so operating system command execution is not confirmed.

The issue is distinct from CVE-2026-44221, CVE-2026-54076, and CVE-2026-54077.

Root Cause

Two missing controls cooperate to enable the bypass. PolyglotQueryEngine lacks an authorization check tying script execution to SecurityDatabaseUser administrator status. GraalPolyglotEngine uses HostAccess.ALL without denying reflective access on bound objects, leaving Class, ClassLoader, and java.lang.reflect members reachable from script context.

Attack Vector

An authenticated reader-role user sends a crafted HTTP POST to the command endpoint with a JavaScript payload. The script walks reflection through the bound database object to load host classes such as java.io.File, then reads arbitrary files the ArcadeDB process can access.

java

// Security patch: engine/src/main/java/com/arcadedb/query/polyglot/GraalPolyglotEngine.java
// fix(GHSA-48qw-824m-86pr): deny reflective escape from bound host objects
private static final HostAccess SANDBOXED_HOST_ACCESS = HostAccess.newBuilder(HostAccess.ALL)
    .denyAccess(Class.class)
    .denyAccess(ClassLoader.class)
    .denyAccess(java.lang.reflect.AccessibleObject.class)
    .denyAccess(java.lang.reflect.Member.class)
    .build();

private GraalPolyglotEngine(final Database database, final Engine engine, final String language,
    final OutputStream output, final List<String> allowedPackages,
    final List<String> restrictedPackages, final long maxExecutionTimeMs) {
  this.database = database;
  // ...
}

Source: GitHub Commit 8ca396c

The patch denies reflective access to Class, ClassLoader, and reflective member types, closing every step of the getClass().getClassLoader().loadClass() chain while leaving normal host method calls on bound objects functional. A companion patch to PolyglotQueryEngine.java imports SecurityDatabaseUser to enforce administrator authorization on script execution paths.

Detection Methods for CVE-2026-65831

Indicators of Compromise

HTTP POST requests to /api/v1/command/{database} containing "language":"js" originating from accounts without administrator role.
Script payloads referencing getClass(), getClassLoader(), loadClass, or Java.type in ArcadeDB command bodies.
ArcadeDB process file reads targeting paths outside the configured database directory such as /etc/passwd, SSH keys, or application configuration files.

Detection Strategies

Inspect ArcadeDB access logs for POST /api/v1/command/ requests where the request body language field is js, python, or another polyglot language.
Correlate authenticated user role with the requested language to flag reader-role users invoking script languages.
Monitor the ArcadeDB JVM for unexpected file descriptor activity outside the database data directory.

Monitoring Recommendations

Enable request-body logging on the ArcadeDB HTTP API and forward logs to a centralized platform for search and alerting.
Alert on any use of reflection keywords (getClassLoader, loadClass, forName) within command endpoint payloads.
Baseline normal script activity per role and alert on deviations, particularly script execution by non-admin accounts.

How to Mitigate CVE-2026-65831

Immediate Actions Required

Upgrade ArcadeDB to version 26.7.1 or later, which enforces admin privileges for polyglot scripting and denies reflective escapes.
Audit existing ArcadeDB user roles and remove any reader accounts that were used to invoke /api/v1/command/ with script languages.
Restrict network exposure of the ArcadeDB HTTP API to trusted management networks until patching is complete.

Patch Information

The fix is available in ArcadeDB Release 26.7.1. See the GitHub Security Advisory GHSA-48qw-824m-86pr and the corresponding GitHub Commit 8ca396c for implementation details.

Workarounds

Disable JavaScript and other polyglot languages in the ArcadeDB configuration if scripting is not required.
Restrict the ArcadeDB HTTP API behind an authenticating reverse proxy that blocks command endpoints for non-admin users.
Run the ArcadeDB process under a dedicated OS account with filesystem permissions limited to the database data directory.

bash

# Verify installed ArcadeDB version and upgrade
curl -s http://localhost:2480/api/v1/server | grep -i version

# Upgrade to patched release
wget https://github.com/ArcadeData/arcadedb/releases/download/26.7.1/arcadedb-26.7.1.tar.gz
tar -xzf arcadedb-26.7.1.tar.gz

# Restrict ArcadeDB process filesystem access via systemd hardening
# /etc/systemd/system/arcadedb.service.d/hardening.conf
# [Service]
# ProtectSystem=strict
# ProtectHome=true
# ReadWritePaths=/var/lib/arcadedb
# NoNewPrivileges=true