CVE-2026-75840: ArcadeDB Information Disclosure Vulnerability

CVE-2026-75840 Overview

CVE-2026-75840 is an arbitrary file read vulnerability in ArcadeDB versions before 26.8.1. The flaw resides in the GraalVM JavaScript sandbox allowlist enforcement, which validates package names using unescaped regular expressions. Attackers who hold trigger creation privileges can invoke Java.type() to reach java.util.zip.ZipFile or java.util.jar.JarFile classes. These classes allow the attacker to read arbitrary files from the host filesystem with the privileges of the ArcadeDB server process. The weakness is categorized under CWE-1025: Comparison Using Wrong Factors.

Critical Impact
Authenticated attackers with trigger creation rights can exfiltrate sensitive files, including configuration, credentials, and application data, from the ArcadeDB host.

Affected Products

ArcadeDB versions prior to 26.8.1
Deployments using the GraalVM JavaScript engine for triggers
Instances exposing trigger creation privileges to non-administrative users

Discovery Timeline

2026-08-18 - CVE-2026-75840 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-75840

Vulnerability Analysis

ArcadeDB embeds GraalVM's JavaScript engine to execute user-defined triggers. To prevent access to sensitive Java classes, the engine relies on a host-class allowlist that filters package names before granting access through Java.type(). The allowlist is compiled from regular expression patterns that were not escaped when constructed from user or configuration input. Because regex metacharacters retain their meaning, package names that should have been treated as literals became broad matchers. Attackers can craft Java.type() invocations that satisfy the pattern while resolving to disallowed classes such as java.util.zip.ZipFile and java.util.jar.JarFile. Both classes accept arbitrary filesystem paths and expose file contents through their entry-reading APIs.

Root Cause

The root cause is unescaped regular expression construction for allowlist enforcement. Metacharacters in configured package prefixes are interpreted as regex operators rather than literal characters. This produces overly permissive match logic that admits classes outside the intended safelist.

Attack Vector

Exploitation requires authenticated access with permission to create triggers. The attacker registers a JavaScript trigger that calls Java.type() against a package expression tuned to bypass the allowlist regex. Once the trigger fires, the returned ZipFile or JarFile object is used to open any file readable by the ArcadeDB process. Entry data is then returned through query results, log output, or trigger side effects. See the ArcadeDB GitHub Security Advisory and the VulnCheck advisory for additional technical detail.

Detection Methods for CVE-2026-75840

Indicators of Compromise

Trigger definitions containing calls to Java.type() referencing java.util.zip.ZipFile, java.util.jar.JarFile, or unusual java.* packages.
ArcadeDB process file handles opening files outside expected data directories, such as /etc/passwd, /root/.ssh/, or application secret stores.
Newly created triggers by non-administrative accounts, particularly on databases previously without triggers.

Detection Strategies

Audit stored trigger source code for JavaScript that invokes Java.type() and inspect the resolved class names.
Review ArcadeDB server logs for GraalVM class-loading events and trigger execution records tied to unfamiliar accounts.
Correlate database authentication events with subsequent trigger creation and unusual outbound data volumes.

Monitoring Recommendations

Enable filesystem auditing on the ArcadeDB service account to flag reads of sensitive paths.
Monitor for privilege changes that grant trigger creation rights to previously limited roles.
Track ArcadeDB version inventory to confirm all instances run 26.8.1 or later.

How to Mitigate CVE-2026-75840

Immediate Actions Required

Upgrade ArcadeDB to version 26.8.1 or later on all instances.
Revoke trigger creation privileges from any account that does not require them.
Rotate credentials, tokens, and keys that were readable by the ArcadeDB process if exploitation is suspected.

Patch Information

The ArcadeDB maintainers addressed the flaw in release 26.8.1 by properly escaping regular expression inputs used for GraalVM host-class allowlist enforcement. Refer to the ArcadeDB GitHub Security Advisory GHSA-wx28-2265-f788 for the official fix reference and upgrade guidance.

Workarounds

Restrict network access to the ArcadeDB API so that only trusted operators can authenticate.
Disable the GraalVM JavaScript engine or trigger functionality if it is not required by workloads.
Run the ArcadeDB process under a dedicated low-privilege user with filesystem access limited to its data directory.

bash

# Verify installed ArcadeDB version and enforce upgrade
arcadedb-server.sh --version
# Expected output should be 26.8.1 or later