CVE-2026-75839: ArcadeDB Information Disclosure Vulnerability

CVE-2026-75839 Overview

CVE-2026-75839 is an Insecure Direct Object Reference (IDOR) vulnerability in ArcadeDB (com.arcadedb:arcadedb-server) versions <= 26.7.3. The Raft cluster-info endpoints GetClusterHandler and PostBootstrapStateHandler authenticate callers but fail to enforce authorization. Any authenticated user on an ArcadeDB high-availability (HA) cluster can enumerate the full server database registry across tenants. The flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. The issue is fixed in ArcadeDB 26.8.1.

Critical Impact
Authenticated low-privilege users can retrieve database names, last transaction IDs, bootstrap fingerprints, and peer/leader cluster topology across databases they do not own.

Affected Products

ArcadeDB com.arcadedb:arcadedb-server versions <= 26.7.3
ArcadeDB HA deployments with arcadedb.ha.enabled set and the ha-raft module loaded
ArcadeDB clusters exposing the Raft cluster-info HTTP endpoints

Discovery Timeline

2026-08-18 - CVE-2026-75839 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-75839

Vulnerability Analysis

The vulnerability resides in two Raft cluster-info handlers: GetClusterHandler and PostBootstrapStateHandler. Both handlers verify that the caller has a valid authenticated session. Neither handler checks whether the authenticated principal is authorized to view metadata for the databases it returns. An authenticated user with access to a single database, or even zero databases, receives the entire cluster registry in the response payload.

Returned metadata includes database names, last transaction identifiers, bootstrap fingerprints, and the current peer and leader topology of the Raft cluster. This cross-tenant leak breaks the isolation model that multi-database ArcadeDB deployments rely on.

Root Cause

The handlers implement authentication but omit per-database authorization. The response is scoped to the server rather than filtered against the caller's access-control list, so the endpoints act as an unrestricted enumeration surface for any principal in the user store.

Attack Vector

Exploitation requires network reachability to the ArcadeDB HTTP API and any valid set of credentials, including credentials scoped to an unrelated database. The attacker issues authenticated HTTP requests to the Raft cluster-info endpoints and parses the returned JSON to enumerate database names and cluster topology. No user interaction is required. Refer to the GitHub Security Advisory GHSA-79wq-w74x-74ch and the VulnCheck advisory for endpoint specifics.

Detection Methods for CVE-2026-75839

Indicators of Compromise

Authenticated HTTP requests to Raft cluster-info endpoints (GetClusterHandler, PostBootstrapStateHandler) from user accounts scoped to a single database or with no database grants.
Unusual enumeration patterns where a single authenticated principal repeatedly queries cluster metadata endpoints.
Access log entries showing cluster-info responses returning database names outside the caller's normal working set.

Detection Strategies

Review ArcadeDB access logs for calls to the Raft cluster-info handlers and correlate the calling principal against database grants in the user store.
Alert on any HTTP 200 responses from cluster-info endpoints where the authenticated user has fewer database grants than the number of databases in the response payload.
Compare the volume of cluster-info requests against a baseline; sudden increases from non-administrative accounts warrant investigation.

Monitoring Recommendations

Forward ArcadeDB HTTP access logs to a centralized log platform and retain them for cross-tenant enumeration analysis.
Monitor arcadedb.ha.enabled cluster nodes for authenticated requests originating from unexpected source IP ranges.
Track authentication events against the user store to identify credential reuse or brute-forced low-privilege accounts that could be leveraged against the vulnerable endpoints.

How to Mitigate CVE-2026-75839

Immediate Actions Required

Upgrade ArcadeDB to version 26.8.1 or later on all HA cluster nodes.
Rotate credentials for any low-privilege or single-database users that existed before the upgrade.
Audit the ArcadeDB user store and remove accounts that no longer require access.

Patch Information

The issue is fixed in ArcadeDB 26.8.1. The patch adds per-database authorization checks to GetClusterHandler and PostBootstrapStateHandler so responses are filtered against the caller's grants. See the GitHub Security Advisory GHSA-79wq-w74x-74ch for release details.

Workarounds

If patching is not immediately possible, restrict network access to the ArcadeDB HTTP API so only trusted administrative hosts can reach the Raft cluster-info endpoints.
Disable HA mode by unsetting arcadedb.ha.enabled or unloading the ha-raft module where cluster functionality is not required.
Place ArcadeDB behind a reverse proxy that blocks unauthenticated and low-privilege principals from reaching the cluster-info paths.

bash

# Configuration example: restrict HA endpoints at the reverse proxy layer
# nginx snippet blocking cluster-info paths from untrusted networks
location ~ ^/api/v1/server/cluster {
    allow 10.0.0.0/24;   # admin subnet
    deny all;
    proxy_pass http://arcadedb_backend;
}