CVE-2026-67356: ArcadeDB Privilege Escalation Vulnerability

CVE-2026-67356 Overview

CVE-2026-67356 is a privilege escalation vulnerability in ArcadeDB versions prior to 26.7.3. The flaw resides in how ArcadeDB exposes the internal LocalDatabase object to JavaScript trigger contexts. The database binds this object with HostAccess.ALL, which disables permission checks on sensitive administrative methods. A schema-administrator can create a JavaScript trigger that calls getSecurity().createUser() to provision server-wide administrator accounts. This action escalates privileges beyond the attacker's original UPDATE_SCHEMA authorization scope. The weakness is categorized under CWE-269: Improper Privilege Management.

Critical Impact
Authenticated users with UPDATE_SCHEMA permission can create server-wide administrator accounts, gaining full control over the ArcadeDB instance and all hosted databases.

Affected Products

ArcadeDB versions prior to 26.7.3
Deployments exposing schema-admin roles to non-privileged tenants
Multi-tenant ArcadeDB instances relying on role-based isolation

Discovery Timeline

2026-08-02 - CVE-2026-67356 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67356

Vulnerability Analysis

ArcadeDB supports JavaScript triggers that execute inside a GraalVM polyglot context. The database engine binds the runtime LocalDatabase instance directly into that context using HostAccess.ALL. This configuration removes the interop guard that would normally restrict which Java methods a script can invoke. As a result, trigger code can reach the security subsystem through database.getSecurity() and invoke administrative APIs such as createUser(), dropUser(), and role modification methods. The engine performs no additional authorization check at the point of invocation because the JavaScript caller inherits the host process's privileges rather than the invoking user's role.

Root Cause

The root cause is an over-permissive sandbox configuration. Binding the real database object with HostAccess.ALL violates the principle of least privilege for script contexts. Security-relevant methods on the exposed object are not gated by the caller's identity or role. A user granted UPDATE_SCHEMA for the purpose of defining triggers therefore gains an indirect path to server-level administrative functions.

Attack Vector

An authenticated attacker holding UPDATE_SCHEMA permission on any database creates a new trigger whose JavaScript body calls database.getSecurity().createUser("attacker", "password", ["admin"]). The trigger fires on a routine event such as an insert or update. Once executed, the newly created administrator account provides network-accessible full control over every database on the server. Exploitation requires no user interaction and can be performed remotely over the ArcadeDB HTTP or binary protocols. Technical detail is documented in the ArcadeDB GitHub Security Advisory GHSA-38pf-6hp2-pxww and the VulnCheck Advisory.

Detection Methods for CVE-2026-67356

Indicators of Compromise

Unexpected user accounts appearing in the ArcadeDB SystemDatabase users table, particularly with the admin role.
Newly defined JavaScript triggers whose bodies reference getSecurity(), createUser, or saveConfiguration.
Audit log entries showing schema modification followed shortly by user creation events from the same session.

Detection Strategies

Inspect trigger definitions across all databases for JavaScript that invokes security or configuration APIs.
Baseline the list of server users and alert on additions that do not originate from the identity provisioning workflow.
Enable ArcadeDB audit logging and forward events to a centralized SIEM for correlation between UPDATE_SCHEMA operations and privilege changes.

Monitoring Recommendations

Track HTTP API calls to trigger creation endpoints and correlate with the acting user's role assignments.
Alert on any invocation path that results in a createUser audit event outside of change-management windows.
Review ArcadeDB server logs for GraalVM polyglot execution warnings and unexpected script compilation events.

How to Mitigate CVE-2026-67356

Immediate Actions Required

Upgrade ArcadeDB to version 26.7.3 or later on all server instances.
Audit existing triggers and remove any that invoke getSecurity() or other administrative APIs.
Rotate credentials for all administrator accounts and remove any unauthorized users introduced since the last known-good baseline.
Restrict the UPDATE_SCHEMA permission to trusted operators until the patch is applied.

Patch Information

The ArcadeDB maintainers released version 26.7.3, which restricts the JavaScript trigger context so that the LocalDatabase binding no longer exposes unrestricted host access to the security subsystem. Refer to the GitHub Security Advisory GHSA-38pf-6hp2-pxww for the fixed release notes and upgrade instructions.

Workarounds

Disable JavaScript triggers in environments where upgrading is not immediately feasible.
Remove UPDATE_SCHEMA permission from all roles that do not require it for daily operations.
Place ArcadeDB behind a network policy that limits management API access to a trusted administrative subnet.

bash

# Configuration example: remove UPDATE_SCHEMA from an untrusted role
# Execute via the ArcadeDB SQL console as a server administrator
UPDATE Role SET permissions = permissions - 'UPDATE_SCHEMA' WHERE name = 'tenant_schema_admin';