CVE-2026-93593: ArcadeDB Auth Bypass Vulnerability

CVE-2026-93593 Overview

ArcadeDB versions before 26.9.1 contain an access control flaw that allows authenticated low-privilege users to bypass explicit deny rules on TimeSeries types. The ArcadeDB Access Control List (ACL) resolver builds permissions from bucket identifiers, but TimeSeries types do not own normal record buckets. This design gap causes permission lookups to fail open, letting attackers read or insert TimeSeries samples despite security-group ACL entries. The weakness is classified as [CWE-863] Incorrect Authorization and affects confidentiality and integrity of time-series data stored in ArcadeDB.

Critical Impact
An authenticated attacker with minimal privileges can read and write TimeSeries samples that should be blocked by security-group deny rules, undermining tenant isolation and data governance controls.

Affected Products

ArcadeDB versions prior to 26.9.1
Deployments that use security-group ACLs to restrict access to TimeSeries types
Multi-tenant ArcadeDB environments relying on type-level deny rules

Discovery Timeline

2026-09-18 - CVE-2026-93593 published to the National Vulnerability Database
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93593

Vulnerability Analysis

ArcadeDB enforces ACLs by mapping permissions to the storage buckets that back a given type. Standard record types own one or more buckets, so the resolver can locate an entry and evaluate grant or deny rules. TimeSeries types deviate from that model because they do not own normal record buckets. When the resolver walks the bucket list for a TimeSeries type, it finds no matching entries and returns an implicit allow rather than falling back to a type-name-based check.

The result is a fail-open authorization decision. Any authenticated user with the ability to reference the TimeSeries type by name can bypass deny rules configured through security groups. Because the check is missing on both read and insert paths, the flaw affects data confidentiality and integrity in the underlying series.

Root Cause

The root cause is an incomplete authorization implementation. The ACL resolver relies exclusively on bucket-to-permission mapping and does not perform a secondary lookup keyed on the type name. TimeSeries types, which store samples through a specialized storage layer instead of standard buckets, are not represented in the bucket-based permission table. Missing entries are interpreted as absence of a deny rather than absence of a grant.

Attack Vector

Exploitation requires network access to the ArcadeDB HTTP or binary interface and valid credentials for a low-privileged account. The attacker issues a query or insert operation targeting a TimeSeries type that a security-group policy explicitly denies. The server processes the request, bypasses the deny rule during permission resolution, and returns samples or accepts new samples. No user interaction, elevated privileges, or specialized tooling are required beyond a standard ArcadeDB client.

A public proof-of-concept is not currently listed. See the GitHub Security Advisory and the VulnCheck Advisory for ArcadeDB for additional technical context.

Detection Methods for CVE-2026-93593

Indicators of Compromise

Successful queries or inserts against TimeSeries types performed by accounts that belong to security groups with explicit deny rules on those types.
ArcadeDB audit log entries showing TimeSeries read or write operations without a corresponding ACL grant.
Unexpected changes in TimeSeries sample counts or value ranges attributed to low-privilege service accounts.

Detection Strategies

Compare configured security-group ACLs against actual access patterns in ArcadeDB audit logs to identify operations that should have been denied.
Deploy database activity monitoring rules that flag TimeSeries operations by users outside an approved allowlist.
Correlate authentication events with subsequent TimeSeries queries to detect low-privilege sessions accessing restricted types.

Monitoring Recommendations

Enable verbose ArcadeDB audit logging for SELECT, INSERT, and UPDATE statements referencing TimeSeries types.
Forward ArcadeDB logs to a centralized SIEM or data lake for retention and correlation with identity telemetry.
Alert on anomalous spikes in TimeSeries write volume, particularly from application accounts that historically only read data.

How to Mitigate CVE-2026-93593

Immediate Actions Required

Upgrade all ArcadeDB instances to version 26.9.1 or later, which restores type-name-based ACL enforcement for TimeSeries types.
Inventory TimeSeries types across databases and confirm that security-group policies match the intended access model after upgrade.
Rotate credentials for low-privilege accounts that may have been used to access restricted TimeSeries data during the exposure window.

Patch Information

The issue is fixed in ArcadeDB 26.9.1. The upstream fix is documented in the GitHub Security Advisory GHSA-wjhv-79gv-2pqg. Administrators should apply the update to every node in a cluster and validate ACL behavior on TimeSeries types after deployment.

Workarounds

Restrict network access to ArcadeDB interfaces so that only trusted application tiers can authenticate.
Remove or disable TimeSeries types that are not actively required until the patch can be deployed.
Reduce the number of low-privilege accounts that can authenticate to databases containing sensitive TimeSeries data.

bash

# Verify running ArcadeDB version and upgrade path
curl -u <admin>:<password> http://<arcadedb-host>:2480/api/v1/server | jq '.version'
# Ensure the returned version is 26.9.1 or later