CVE-2026-67340: ArcadeDB RCE Vulnerability

CVE-2026-67340 Overview

CVE-2026-67340 is a remote code execution vulnerability in ArcadeDB versions before 26.7.2. The arcadedb-engine component exposes java.lang.* classes to JavaScript trigger scripts through its ScriptTriggerExecutor, which adds java.lang.* to the allowed packages list. An authenticated user holding UPDATE_SCHEMA permission can create a JavaScript trigger that calls java.lang.Runtime.getRuntime().exec() or java.lang.ProcessBuilder via the Java.type bridge. When the trigger fires, the attacker gains operating system command execution under the database process account. The issue is tracked under CWE-94: Improper Control of Generation of Code.

Critical Impact
Authenticated attackers with schema modification rights can achieve full OS command execution on the ArcadeDB host.

Affected Products

ArcadeDB arcadedb-engine versions before 26.7.2
Deployments exposing schema modification permissions to non-administrative users
Any application embedding the vulnerable ArcadeDB engine with JavaScript triggers enabled

Discovery Timeline

2026-08-01 - CVE-2026-67340 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67340

Vulnerability Analysis

ArcadeDB supports server-side JavaScript triggers that execute in response to database events. The engine restricts which Java classes trigger scripts can reference through an allowed-packages list enforced by ScriptTriggerExecutor. This list incorrectly includes java.lang.*, exposing high-risk classes such as Runtime, ProcessBuilder, and System to untrusted script authors.

The embedded scripting engine resolves host classes through the Java.type() bridge. Because java.lang sits inside the allowed set, a trigger can obtain a reference to Runtime and invoke exec() with attacker-supplied arguments. The resulting process runs with the privileges of the ArcadeDB server.

Exploitation requires an authenticated account with UPDATE_SCHEMA permission, but no user interaction. The trigger fires on the next matching database event, converting a schema-write primitive into arbitrary command execution.

Root Cause

The root cause is an overly permissive allow-list in ScriptTriggerExecutor. Adding java.lang.* to allowed packages defeats the sandbox because that package contains classes designed for process control, class loading, and reflection. The design assumed schema privileges implied trust equivalent to server administration, which is not enforced elsewhere.

Attack Vector

An attacker authenticates to ArcadeDB with an account granted UPDATE_SCHEMA. The attacker creates a JavaScript trigger bound to a common event such as onAfterInsert. Inside the trigger body, the script resolves java.lang.Runtime through Java.type and calls getRuntime().exec() with a shell command. Any subsequent database operation that triggers the event executes the payload on the host. The attack is fully network-reachable and does not require local access.

No public proof-of-concept code is currently indexed. Refer to the GitHub Security Advisory GHSA-x9f9-r4m8-9xc2 and the VulnCheck Advisory on ArcadeDB for technical detail.

Detection Methods for CVE-2026-67340

Indicators of Compromise

Newly created or modified JavaScript triggers referencing Java.type, java.lang.Runtime, java.lang.ProcessBuilder, or getRuntime
Child processes spawned by the ArcadeDB JVM such as sh, bash, cmd.exe, powershell.exe, or curl
Unexpected outbound network connections originating from the ArcadeDB service account
Schema change audit entries from non-administrative accounts holding UPDATE_SCHEMA

Detection Strategies

Audit the ArcadeDB schema for triggers containing string literals Java.type, Runtime, or ProcessBuilder and review each entry
Enable and forward ArcadeDB server logs to a centralized log platform and alert on trigger creation events
Correlate JVM process telemetry with schema change events to surface trigger-driven command execution

Monitoring Recommendations

Monitor process ancestry where the ArcadeDB Java process is the parent of a shell or scripting interpreter
Track authentication events for accounts that hold UPDATE_SCHEMA and flag anomalous session sources
Alert on outbound traffic from the database host to previously unseen destinations, particularly on non-database ports

How to Mitigate CVE-2026-67340

Immediate Actions Required

Upgrade ArcadeDB to version 26.7.2 or later without delay
Inventory existing triggers and remove any that reference Java.type, Runtime, or ProcessBuilder
Revoke UPDATE_SCHEMA from all accounts that do not require it and rotate credentials for privileged users
Restrict network access to the ArcadeDB management interface to trusted administrative networks

Patch Information

The fix ships in ArcadeDB 26.7.2. The patched ScriptTriggerExecutor removes java.lang.* from the allowed packages list, preventing trigger scripts from resolving Runtime and related host classes via Java.type. See the GitHub Security Advisory GHSA-x9f9-r4m8-9xc2 for the release notes.

Workarounds

If patching is not immediately possible, disable JavaScript triggers or the scripting subsystem in the ArcadeDB configuration
Limit UPDATE_SCHEMA to a small set of administrator accounts protected by strong authentication
Run the ArcadeDB service under a low-privilege OS account with no shell access and restrictive filesystem permissions
Apply egress filtering on the database host to block outbound connections to arbitrary destinations

bash

# Configuration example: disable script triggers until patched
# Set in server configuration or JVM system properties
-Darcadedb.serverSecurityAlgorithm=PBKDF2WithHmacSHA256
-Darcadedb.polyglotCommand.enabled=false
# Then restart the ArcadeDB service and verify triggers are inert