CVE-2026-67343: ArcadeDB Information Disclosure Flaw

CVE-2026-67343 Overview

CVE-2026-67343 is an information disclosure vulnerability in ArcadeDB versions before 26.7.2. The GET /api/v1/server endpoint fails to redact the arcadedb.ha.clusterToken value, returning it in cleartext to authenticated users. Attackers can replay the leaked token using the X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate the root account. This impersonation grants administrative capabilities including user creation, database manipulation, and server shutdown. The flaw is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Any authenticated user can escalate to root and perform administrative actions across the ArcadeDB cluster.

Affected Products

ArcadeDB versions prior to 26.7.2
Deployments using high-availability cluster configuration with arcadedb.ha.clusterToken
ArcadeDB REST API endpoint GET /api/v1/server

Discovery Timeline

2026-08-01 - CVE-2026-67343 published to the National Vulnerability Database (NVD)
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67343

Vulnerability Analysis

ArcadeDB exposes cluster state and configuration through the GET /api/v1/server REST endpoint. In vulnerable builds, the JSON response includes the arcadedb.ha.clusterToken setting without redaction. This token authorizes inter-node communication in high-availability deployments and is treated as a trust anchor by the server.

Once an attacker obtains the token, they can craft requests carrying X-ArcadeDB-Cluster-Token alongside X-ArcadeDB-Forwarded-User: root. The server accepts these headers as evidence of a trusted forwarded identity and executes the request in the security context of root. This bypasses the account permissions of the calling user.

Exploitation requires only low-privilege authenticated access to the HTTP API. Successful abuse enables creation of new administrative users, arbitrary database read and write operations, and full server shutdown.

Root Cause

The defect is a missing output sanitization in the server information handler. Sensitive high-availability configuration values, specifically arcadedb.ha.clusterToken, are serialized directly into the API response instead of being filtered from the settings map exposed to non-privileged callers.

Attack Vector

The attack is network-reachable and requires authentication with any valid ArcadeDB account. The workflow is:

Authenticate to the ArcadeDB HTTP API with a low-privilege user.
Issue GET /api/v1/server and parse the arcadedb.ha.clusterToken field from the response.
Send subsequent administrative requests with the headers X-ArcadeDB-Cluster-Token: <leaked-token> and X-ArcadeDB-Forwarded-User: root.
Execute administrative actions such as user creation, database drops, or POST /api/v1/server shutdown commands.

No public proof-of-concept exploit is currently listed against this CVE. See the GitHub Security Advisory GHSA-46hj-24h4-j8gf and the VulnCheck Advisory for further technical details.

Detection Methods for CVE-2026-67343

Indicators of Compromise

HTTP requests to GET /api/v1/server originating from non-administrative accounts.
Requests carrying the X-ArcadeDB-Cluster-Token header from clients that are not legitimate cluster peers.
Requests with X-ArcadeDB-Forwarded-User: root that do not originate from trusted cluster nodes.
Unexpected creation of privileged ArcadeDB users or unscheduled server shutdown events.

Detection Strategies

Inspect ArcadeDB access logs for /api/v1/server calls followed by administrative API calls from the same source with cluster headers.
Correlate authentication events with subsequent header-based identity forwarding to identify impersonation of root.
Alert on any use of X-ArcadeDB-Forwarded-User from source addresses outside the documented cluster peer set.

Monitoring Recommendations

Forward ArcadeDB HTTP access and audit logs to a centralized analytics platform for query and correlation.
Baseline normal cluster peer IP addresses and flag deviations that present the cluster token.
Track administrative actions such as user creation, role changes, and database drop operations for review.

How to Mitigate CVE-2026-67343

Immediate Actions Required

Upgrade ArcadeDB to version 26.7.2 or later on all cluster nodes.
Rotate the arcadedb.ha.clusterToken value after upgrading, since prior tokens may have been disclosed.
Audit existing ArcadeDB user accounts and remove any unrecognized administrative users.
Review recent administrative activity, including database and server shutdown events, for signs of abuse.

Patch Information

The ArcadeDB maintainers addressed the disclosure in version 26.7.2 by redacting sensitive high-availability configuration values from the GET /api/v1/server response. Refer to the GitHub Security Advisory GHSA-46hj-24h4-j8gf for release notes and commit references.

Workarounds

Restrict network access to the ArcadeDB HTTP API so that only trusted management networks can reach it.
Block or filter the X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers at an upstream reverse proxy for non-cluster clients.
Limit ArcadeDB API accounts to the minimum privileges required and disable unused low-privilege accounts.

bash

# Example reverse proxy rule to strip cluster impersonation headers from external clients
# NGINX configuration
location /api/ {
    proxy_set_header X-ArcadeDB-Cluster-Token "";
    proxy_set_header X-ArcadeDB-Forwarded-User "";
    proxy_pass http://arcadedb_backend;
}