CVE-2026-75851 Overview
CVE-2026-75851 is a privilege escalation vulnerability in ArcadeDB server (com.arcadedb:arcadedb-server) affecting versions 26.7.3 and earlier. The server fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user. This causes the scripting authorization gate to become a no-op. A low-privileged user with read access to a single database can submit an asynchronous JavaScript command and escalate to full administrative control. ArcadeDB fixed the issue in version 26.8.1.
Critical Impact
Authenticated users with only read access can create server-wide administrators and take full control of the ArcadeDB instance.
Affected Products
- ArcadeDB server (com.arcadedb:arcadedb-server) versions 26.7.3 and earlier
- Deployments exposing the /api/v1/command HTTP endpoint
- Multi-tenant ArcadeDB clusters with low-privileged database users
Discovery Timeline
- 2026-08-18 - CVE-2026-75851 published to NVD
- 2026-08-18 - Last updated in NVD database
Technical Details for CVE-2026-75851
Vulnerability Analysis
The flaw is an improper privilege management issue tracked as [CWE-269]. ArcadeDB's HTTP command endpoint accepts an awaitResponse:false parameter that dispatches the command to an asynchronous worker thread. The synchronous execution path correctly binds the authenticated principal to the DatabaseContext, which the scripting authorization gate consults before allowing sensitive operations.
On the asynchronous path, the server does not propagate the caller's identity to the worker thread. The worker's DatabaseContext has no bound user, so the scripting authorization check silently passes. Any authenticated user, including one with only read privileges on a single database, can therefore execute JavaScript with unrestricted host access.
Root Cause
The root cause is missing principal propagation across thread boundaries. Authorization state stored in thread-local or context-bound structures is not copied when work is handed off to the async command executor. The scripting gate treats an absent user as authorized rather than as a deny-by-default condition.
Attack Vector
An attacker with valid low-privilege credentials sends a POST request to /api/v1/command with language=js and awaitResponse:false. The submitted JavaScript payload can invoke privileged APIs such as database.getSecurity().createUser to provision a server-wide administrator account. Once the new administrator exists, the attacker authenticates with those credentials and gains full control of the ArcadeDB server, including access to all databases and configuration.
See the GitHub Security Advisory GHSA-5j4x-3jfw-8xv3 and the VulnCheck Advisory on ArcadeDB for further technical details.
Detection Methods for CVE-2026-75851
Indicators of Compromise
- HTTP POST requests to /api/v1/command containing language=js and awaitResponse:false from non-administrative accounts.
- Unexpected new administrator accounts created through database.getSecurity().createUser calls.
- Server-side JavaScript execution originating from users with only read scope on a single database.
Detection Strategies
- Inspect ArcadeDB HTTP access logs for awaitResponse=false parameters combined with language=js payloads.
- Correlate command submissions with subsequent security schema changes such as user creation or role assignment.
- Alert on process behavior consistent with server-side script execution launching child processes or file system access from the ArcadeDB JVM.
Monitoring Recommendations
- Enable audit logging of all authentication events and administrative changes in ArcadeDB.
- Baseline the set of privileged users and generate alerts on any additions.
- Forward ArcadeDB and reverse proxy logs to a centralized analytics platform for retention and correlation.
How to Mitigate CVE-2026-75851
Immediate Actions Required
- Upgrade ArcadeDB server to version 26.8.1 or later, which propagates the authenticated principal to async workers.
- Audit existing user and role definitions for unauthorized administrator accounts and revoke any that are unexpected.
- Rotate credentials for all ArcadeDB users following the upgrade to invalidate any tokens obtained during the exposure window.
Patch Information
ArcadeDB fixed CVE-2026-75851 in version 26.8.1. Upgrade instructions and release notes are available in the GitHub Security Advisory GHSA-5j4x-3jfw-8xv3.
Workarounds
- Restrict network access to the /api/v1/command endpoint using a reverse proxy or network policy, allowing only trusted clients.
- Disable server-side JavaScript execution where the deployment does not require it.
- Reject requests containing awaitResponse:false at an upstream proxy until the upgrade is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
