CVE-2026-67341 Overview
CVE-2026-67341 is a critical authorization bypass vulnerability in ArcadeDB versions before 26.7.2. The flaw resides in the SQL DEFINE FUNCTION statement when combined with LANGUAGE js. ArcadeDB fails to enforce scripting authorization checks on this code path, allowing any authenticated user with database access to define and execute arbitrary JavaScript code on the server. This bypasses controls that restrict scripting privileges to administrators. The weakness is classified as CWE-863: Incorrect Authorization and enables full compromise of database confidentiality, integrity, and availability.
Critical Impact
Attackers with non-administrative database credentials can execute arbitrary JavaScript on the ArcadeDB server, leading to remote code execution and full data compromise.
Affected Products
- ArcadeDB versions before 26.7.2
- ArcadeDB deployments exposing SQL command endpoints to authenticated users
- ArcadeDB instances where non-administrative accounts have database access
Discovery Timeline
- 2026-08-01 - CVE-2026-67341 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-67341
Vulnerability Analysis
ArcadeDB supports server-side scripting through SQL statements such as DEFINE FUNCTION ... LANGUAGE js. The database engine is designed to restrict scripting operations to administrative roles because JavaScript execution provides full access to the underlying runtime. The vulnerable versions do not apply the scripting authorization check to the DEFINE FUNCTION code path. Any user who can submit SQL commands can therefore register a JavaScript function whose body is arbitrary code. When that function is invoked, or in some paths when it is defined, the attacker-supplied JavaScript runs in the ArcadeDB server process.
The outcome is remote code execution in the context of the ArcadeDB service account. Attackers can read database contents, modify records, exfiltrate data, or pivot into the host operating system.
Root Cause
The root cause is a missing authorization check on the DEFINE FUNCTION SQL handler [CWE-863]. Scripting privileges are enforced on some entry points such as direct script execution, but the same policy is not applied when a function is defined with LANGUAGE js. The trust boundary between authenticated user roles and administrative scripting is broken at this specific SQL statement.
Attack Vector
Exploitation requires network access to the ArcadeDB SQL interface and valid credentials for any database user. The attacker submits a DEFINE FUNCTION statement with LANGUAGE js whose function body contains malicious JavaScript. The server accepts the definition without checking scripting privileges. Invoking the function executes the attacker-controlled code. No user interaction is required and complexity is low. See the GitHub Security Advisory GHSA-vwjc-v7x7-cm6g and the VulnCheck Advisory on ArcadeDB for additional technical detail.
Detection Methods for CVE-2026-67341
Indicators of Compromise
- SQL statements containing DEFINE FUNCTION combined with LANGUAGE js submitted by non-administrator accounts.
- Unexpected outbound network connections originating from the ArcadeDB server process.
- Child processes spawned by the ArcadeDB JVM, particularly shells or scripting interpreters.
- New or modified stored functions in ArcadeDB whose body contains system calls, HTTP clients, or file I/O routines.
Detection Strategies
- Enable and review ArcadeDB query logs for DEFINE FUNCTION statements and correlate the invoking user with expected administrative accounts.
- Alert on any process spawned as a descendant of the ArcadeDB service, which normally does not fork operating-system processes.
- Baseline network egress from database hosts and flag deviations that coincide with SQL activity.
Monitoring Recommendations
- Ingest ArcadeDB application logs into a centralized logging or SIEM platform and retain them for post-incident review.
- Monitor authentication events for the ArcadeDB SQL endpoint and flag brute-force or credential-stuffing patterns against low-privilege accounts.
- Track integrity of the ArcadeDB configuration and stored function catalog to detect unauthorized additions.
How to Mitigate CVE-2026-67341
Immediate Actions Required
- Upgrade ArcadeDB to version 26.7.2 or later on all instances.
- Audit existing database users and remove accounts that do not require SQL access.
- Review the current set of defined functions and remove any LANGUAGE js functions that were not created by an administrator.
- Rotate credentials for ArcadeDB user accounts after patching, in case they were exposed during the exploitation window.
Patch Information
The issue is resolved in ArcadeDB 26.7.2. The fix enforces the scripting authorization check on the DEFINE FUNCTION SQL path so that only users with administrative scripting privileges can register JavaScript functions. Refer to the GitHub Security Advisory GHSA-vwjc-v7x7-cm6g for the authoritative fix details.
Workarounds
- Restrict network access to the ArcadeDB SQL endpoint using firewall rules or a reverse proxy so that only trusted hosts can reach it.
- Disable or remove non-administrative database accounts until the upgrade to 26.7.2 is complete.
- Run the ArcadeDB service under a low-privilege operating system account to limit the impact of successful JavaScript execution.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
