CVE-2026-75843 Overview
CVE-2026-75843 is a privilege escalation vulnerability in ArcadeDB versions before 26.8.1. The flaw resides in the gRPC transaction executor, which fails to bind the authenticated principal to its worker thread inside beginTransaction. As a result, authenticated users with read-only privileges bypass scripting authorization checks and execute arbitrary JavaScript through executeCommand. Attackers can leverage this behavior to create server-wide administrator accounts and gain full control of the database. The issue is tracked under CWE-269: Improper Privilege Management.
Critical Impact
An authenticated low-privilege reader can execute unrestricted JavaScript on the ArcadeDB server, create administrator accounts, and take full control of the database instance.
Affected Products
- ArcadeDB versions prior to 26.8.1
- ArcadeDB deployments exposing the gRPC transaction interface
- Multi-tenant ArcadeDB instances with reader-tier accounts
Discovery Timeline
- 2026-08-18 - CVE-2026-75843 published to NVD
- 2026-08-18 - Last updated in NVD database
Technical Details for CVE-2026-75843
Vulnerability Analysis
ArcadeDB exposes a gRPC service that accepts transactional commands from authenticated clients. When a client invokes beginTransaction, the server dispatches subsequent operations onto a worker thread bound to a transaction identifier. The authenticated principal, however, is not propagated to that worker thread. Downstream authorization logic that gates JavaScript execution reads the security context from thread-local state and finds no scripting restriction in effect.
An authenticated reader can therefore call executeCommand with a valid transaction ID and submit JavaScript payloads that the server treats as unrestricted. The scripting engine runs with server-level privileges, allowing the caller to invoke administrative APIs, mutate the security catalog, and provision new users.
Root Cause
The root cause is missing principal propagation across asynchronous execution boundaries. The gRPC handler resolves credentials at connection time but does not attach the resulting security context to the transaction executor thread. Authorization checks that rely on that context default to a permissive state, effectively skipping the scripting privilege check that would otherwise reject the request.
Attack Vector
Exploitation requires network reachability to the gRPC endpoint and a valid low-privilege account. The attacker opens a gRPC session, calls beginTransaction to obtain a transaction ID, then submits executeCommand with a JavaScript payload. The payload creates a new user in the server security catalog and grants administrative roles. Once the administrator account exists, the attacker authenticates directly and operates without transaction indirection. Refer to the GitHub Security Advisory GHSA-p29f-345w-4qwf and the VulnCheck Advisory for ArcadeDB for authoritative technical details.
Detection Methods for CVE-2026-75843
Indicators of Compromise
- Unexpected creation of administrator or root-equivalent accounts in the ArcadeDB security catalog shortly after a gRPC session from a reader account.
- gRPC executeCommand requests originating from accounts that historically only issue read queries.
- JavaScript command payloads referencing user management APIs such as user creation or role assignment functions.
- Reader-tier accounts issuing beginTransaction calls at rates inconsistent with their normal workload.
Detection Strategies
- Correlate gRPC command telemetry with the authenticated principal and alert when JavaScript payloads originate from non-privileged roles.
- Monitor ArcadeDB audit logs for role assignments, user creation, and permission grants that occur inside transaction contexts.
- Baseline command types per user role and flag deviations, particularly JavaScript execution from read-only principals.
Monitoring Recommendations
- Enable verbose audit logging for the ArcadeDB security subsystem, including user administration events.
- Forward ArcadeDB and host logs to a centralized data lake and retain gRPC request metadata for retrospective hunts.
- Track outbound network activity from ArcadeDB hosts to detect follow-on actions once an attacker gains administrative control.
How to Mitigate CVE-2026-75843
Immediate Actions Required
- Upgrade ArcadeDB to version 26.8.1 or later on all server nodes and clients.
- Audit the ArcadeDB security catalog and remove any unrecognized administrator or elevated-role accounts.
- Rotate credentials for all ArcadeDB accounts, prioritizing administrative and service principals.
- Restrict network access to the gRPC endpoint to trusted management networks until patches are applied.
Patch Information
ArcadeDB 26.8.1 fixes the vulnerability by binding the authenticated principal to the gRPC transaction executor thread so that scripting authorization checks run against the correct security context. Consult the GitHub Security Advisory GHSA-p29f-345w-4qwf for release notes and upgrade guidance.
Workarounds
- Disable the gRPC transaction interface if it is not required by application workloads.
- Remove JavaScript command execution privileges from all non-administrative roles and review scripting policy defaults.
- Place the ArcadeDB gRPC port behind a mutual TLS-terminated proxy that enforces client identity and blocks untrusted callers.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
