CVE-2026-67342: ArcadeDB Auth Bypass Vulnerability

CVE-2026-67342 Overview

ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints. The affected handlers fail to validate database access permissions before processing requests. Attackers can access and modify databases they are not authorized to use by directly calling the vulnerable endpoints with arbitrary database parameters. The flaw is tracked as CWE-639: Authorization Bypass Through User-Controlled Key and requires no authentication or user interaction over the network.

Critical Impact
Unauthenticated remote attackers can read and modify arbitrary ArcadeDB databases by specifying target database names in HTTP requests to unprotected handler endpoints.

Affected Products

ArcadeDB versions prior to 26.7.2
ArcadeDB HTTP time series endpoint handler
ArcadeDB HTTP batch, Prometheus, and Grafana endpoint handlers

Discovery Timeline

2026-08-01 - CVE-2026-67342 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67342

Vulnerability Analysis

ArcadeDB exposes multiple HTTP endpoints for administrative and data operations, including handlers for time series ingestion, batch operations, Prometheus scraping, and Grafana integration. In versions before 26.7.2, these handlers accept a database identifier as a request parameter but do not verify that the authenticated principal (or the request context) has permission to access the specified database.

Because the authorization check is missing, any caller reaching the endpoint can substitute the target database name and operate on databases outside their granted scope. The impact extends to confidentiality, integrity, and availability of stored data across all databases hosted on the instance.

Root Cause

The root cause is missing access control enforcement in the affected HTTP handler classes. The handlers trust the database parameter supplied in the request path or body without cross-referencing it against the caller's permission set. This pattern maps to CWE-639, where a user-controlled key is used to look up a resource without an authorization check.

Attack Vector

Exploitation requires only network reachability to the ArcadeDB HTTP interface. An attacker crafts an HTTP request to one of the affected handlers (time series, batch, Prometheus, or Grafana) and sets the database parameter to a target database the attacker is not entitled to access. The server processes the request against the specified database and returns data or applies modifications. No credentials or prior interaction are required to reach the vulnerable code path. See the GitHub Security Advisory GHSA-x8mg-6r4p-87pf for handler-level detail.

Detection Methods for CVE-2026-67342

Indicators of Compromise

HTTP requests to /api/v1/batch, time series, Prometheus, or Grafana endpoints referencing database names that the requesting identity does not own.
Unexpected write, insert, or update operations against databases from source IPs that historically only queried a different database.
Access log entries showing the same client iterating through multiple database name values in short succession.

Detection Strategies

Correlate ArcadeDB access logs with the requesting user's authorized database list and alert on mismatches.
Deploy signatures on web application firewalls or reverse proxies that flag calls to the affected handler paths from unauthenticated sources.
Baseline normal Prometheus and Grafana integration traffic and alert on requests targeting databases outside the integration's expected scope.

Monitoring Recommendations

Ingest ArcadeDB HTTP access logs into a centralized SIEM or data lake for cross-source correlation.
Monitor for anomalous spikes in batch or time series endpoint calls, particularly from external network ranges.
Track authentication outcomes and per-database operation counts to identify lateral database access patterns.

How to Mitigate CVE-2026-67342

Immediate Actions Required

Upgrade ArcadeDB to version 26.7.2 or later on all instances exposing the HTTP interface.
Restrict network exposure of the ArcadeDB HTTP port to trusted management networks until patching is complete.
Audit access logs for prior requests to time series, batch, Prometheus, and Grafana handlers that referenced unexpected database names.
Rotate credentials for any database whose contents may have been exposed while the vulnerable version was reachable.

Patch Information

ArcadeDB 26.7.2 addresses the missing authorization checks in the affected HTTP handlers. Details are published in the GitHub Security Advisory GHSA-x8mg-6r4p-87pf and the VulnCheck Advisory on ArcadeDB. Apply the upgrade as the primary remediation.

Workarounds

Place ArcadeDB behind a reverse proxy that enforces authentication and restricts access to the affected handler paths.
Disable unused integrations such as Prometheus or Grafana endpoints if they are not required in the deployment.
Apply network segmentation and firewall rules so only authorized service accounts can reach the ArcadeDB HTTP interface.

bash

# Example: restrict ArcadeDB HTTP endpoint access with iptables until patched
iptables -A INPUT -p tcp --dport 2480 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 2480 -j DROP