CVE-2026-67344: ArcadeDB Auth Bypass Vulnerability

CVE-2026-67344 Overview

CVE-2026-67344 is a missing authorization vulnerability [CWE-862] in ArcadeDB before version 26.7.2. The database fails to enforce the updateSchema permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations. These operations map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. Authenticated users with only read access, including holders of read-only API tokens, can submit ALTER TYPE statements through the HTTP command endpoint. This bypasses the documented updateSchema permission boundary and mutates custom schema metadata and bucket-selection strategy.

Critical Impact
A read-only authenticated user can corrupt schema metadata and record routing in ArcadeDB, undermining data integrity and confidentiality guarantees enforced by the permission model.

Affected Products

ArcadeDB versions prior to 26.7.2
HTTP command endpoint accepting SQL ALTER TYPE statements
LocalDocumentType implementations exposing setCustomValue and setBucketSelectionStrategy

Discovery Timeline

2026-08-01 - CVE-2026-67344 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67344

Vulnerability Analysis

ArcadeDB defines an updateSchema permission that gates modifications to a database's schema definitions. The ALTER TYPE SQL statement invokes internal methods that mutate schema state, including custom properties and bucket-selection strategies. The implementation of the CUSTOM and BUCKETSELECTIONSTRATEGY variants of ALTER TYPE omits the authorization check that governs other schema-mutating operations.

An attacker holding any valid credential, including a read-only API token intended solely for query workloads, can invoke these statements through the HTTP command endpoint. The server applies the schema mutation without verifying that the caller holds updateSchema. This produces a divergence between the documented permission model and the actual enforcement surface.

Impact includes corruption of custom schema metadata stored on a type, alteration of the bucket-selection strategy that determines how records route across storage buckets, and downstream effects on query correctness and cluster behavior. See the GitHub Security Advisory and the VulnCheck Advisory on ArcadeDB for additional context.

Root Cause

The root cause is a missing authorization check [CWE-862] on two specific ALTER TYPE code paths. The handlers for CUSTOM and BUCKETSELECTIONSTRATEGY do not consult the updateSchema permission before delegating to LocalDocumentType.setCustomValue and LocalDocumentType.setBucketSelectionStrategy.

Attack Vector

The attacker authenticates to ArcadeDB with any credential, including a read-only token. The attacker sends an HTTP POST to the command endpoint with a SQL payload such as ALTER TYPE <type> CUSTOM <key>=<value> or ALTER TYPE <type> BUCKETSELECTIONSTRATEGY <strategy>. The server executes the statement and persists the change without checking updateSchema. No user interaction is required, and the request completes in a single HTTP round trip.

// Verified exploit code is not published in the referenced advisories.
// Refer to the GitHub Security Advisory GHSA-8vr5-263f-x5r3 for details.

Detection Methods for CVE-2026-67344

Indicators of Compromise

HTTP command endpoint requests containing ALTER TYPE combined with the CUSTOM or BUCKETSELECTIONSTRATEGY keyword originating from read-only accounts or tokens.
Unexpected changes to type-level custom properties or bucket-selection strategy values in ArcadeDB schema exports.
Query routing anomalies or inconsistent record placement after schema audits.

Detection Strategies

Enable ArcadeDB command auditing and alert on any ALTER TYPE statement executed by accounts that are not authorized schema administrators.
Compare periodic schema snapshots to detect unauthorized modifications to custom metadata or bucketSelectionStrategy fields.
Inspect reverse proxy or web application firewall logs for POST requests to /api/v1/command/* containing ALTER TYPE substrings from low-privilege identities.

Monitoring Recommendations

Forward ArcadeDB HTTP access logs and command logs to a centralized log store for correlation across identity and time.
Track token issuance and usage patterns so that read-only tokens submitting schema-mutating SQL are flagged immediately.
Baseline the expected set of schema administrators and alert on deviations.

How to Mitigate CVE-2026-67344

Immediate Actions Required

Upgrade ArcadeDB to version 26.7.2 or later on all servers and cluster nodes.
Rotate API tokens that may have been used to submit ALTER TYPE statements against affected instances.
Review schema state for each database and revert any unauthorized changes to custom values and bucketSelectionStrategy settings.

Patch Information

The issue is fixed in ArcadeDB 26.7.2. The patch adds the missing updateSchema permission enforcement to the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY code paths. Consult the GitHub Security Advisory GHSA-8vr5-263f-x5r3 for release notes and commit references.

Workarounds

Restrict network access to the ArcadeDB HTTP command endpoint to trusted management networks until patching is complete.
Suspend issuance of shared or long-lived read-only tokens and require short-lived, scoped credentials.
Place a reverse proxy or API gateway in front of ArcadeDB and block requests containing ALTER TYPE from non-administrator identities.

bash

# Example nginx rule to block ALTER TYPE from non-admin clients
location /api/v1/command/ {
    if ($request_body ~* "ALTER\s+TYPE") {
        return 403;
    }
    proxy_pass http://arcadedb_backend;
}