CVE-2026-93594: ArcadeDB Auth Bypass Vulnerability

CVE-2026-93594 Overview

ArcadeDB versions through 26.8.1 contain a broken access control flaw [CWE-863] that lets authenticated users bypass per-type and per-record permission checks. The database enforces access-control rules only in LocalBucket, keyed on file id. Query paths that reach record data through LSM index files or the TimeSeries engine skip the permission check entirely. An authenticated principal denied readRecord or deleteRecord on a type can still read indexed key values, record IDs, min/max values, and TimeSeries samples using ordinary SQL. The same paths allow deletion of index entries, which desynchronizes indexes from data and can defeat unique constraints. The issue affects embedded and server deployments across HTTP, Bolt, Postgres, and Gremlin transports. ArcadeDB fixed the vulnerability in version 26.9.1.

Critical Impact

Authenticated users with denied ACLs can enumerate protected type data, exfiltrate indexed values, and corrupt index integrity via a single SQL statement.

Affected Products

• ArcadeDB Engine (Maven artifact com.arcadedb:arcadedb-engine) versions through 26.8.1
• ArcadeDB server deployments (HTTP, Bolt, Postgres, Gremlin transports)
• ArcadeDB embedded deployments

Discovery Timeline

• 2026-09-18 - CVE-2026-93594 published to the National Vulnerability Database
• 2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-93594

Vulnerability Analysis

ArcadeDB implements ACL enforcement inside LocalBucket, the component that reads and writes physical record files. The permission check is keyed on the file id of the bucket. Any read or write path that does not pass through LocalBucket never triggers the ACL evaluation.

Two query paths escape enforcement. First, the LSM index files backing secondary indexes expose indexed key values and record IDs directly. A statement such as SELECT key, rid FROM INDEX:Type[field] returns protected data without touching LocalBucket. The same pathway serves MAX and MIN shortcut evaluations and record counts. Second, the TimeSeries engine reads its samples through its own storage layer, so counting and reading TimeSeries data bypasses the check.

The write side is equally permissive. Attackers can issue DELETE FROM INDEX:Type[field] to remove index entries while the underlying records remain. This desynchronization breaks unique constraints and allows duplicate insertions that would otherwise be rejected.

Schema discovery is unrestricted. SELECT FROM schema:indexes returns all index and type names without ACL filtering, giving an authenticated attacker the identifiers needed to target protected structures.

Root Cause

The access control model assumes that all record access flows through LocalBucket. Index and TimeSeries read/write paths violate that assumption. This is a classic missing authorization defect [CWE-863] where the check exists but is not applied on every code path that exposes the protected resource.

Attack Vector

An attacker requires network access to an ArcadeDB endpoint and valid credentials for any principal bound to the database. The principal can hold explicit deny rules for the target type. Exploitation uses standard SQL over any supported transport, requires no special privileges beyond authentication, and produces no anomalous protocol traffic.

See the GitHub Security Advisory GHSA-2c8m-q484-jv7m and the VulnCheck Advisory for ACL Bypass for full technical details.

Detection Methods for CVE-2026-93594

Indicators of Compromise

• Queries referencing INDEX: pseudo-targets issued by principals that lack readRecord on the referenced type.
• DELETE FROM INDEX: statements in query logs, especially followed by insertions that violate previously enforced unique constraints.
• Repeated SELECT FROM schema:indexes calls from low-privilege accounts performing reconnaissance.
• Unexplained TimeSeries count or sample-read operations from accounts without type-level read permission.

Detection Strategies

• Enable query logging on all ArcadeDB transports (HTTP, Bolt, Postgres, Gremlin) and alert on SQL statements that reference INDEX: or schema:indexes targets.
• Correlate authenticated user identity with target type ACLs; flag any successful index-scoped query where the principal is denied on the underlying type.
• Monitor for index/data desynchronization by running periodic integrity checks comparing index entry counts to record counts on constrained types.

Monitoring Recommendations

• Forward ArcadeDB server logs to a centralized analytics platform and retain them long enough to reconstruct pre-patch activity.
• Build baseline profiles of legitimate index-scoped query usage per application account so anomalous access stands out.
• Track unique-constraint violation errors on write paths as a lagging indicator of prior index tampering.

How to Mitigate CVE-2026-93594

Immediate Actions Required

• Upgrade ArcadeDB to version 26.9.1 or later on all embedded and server deployments.
• Inventory every principal bound to ArcadeDB databases and revoke unused credentials to shrink the exploitable population.
• Review query logs for the indicators above to identify any pre-patch exploitation.
• Rebuild indexes on any type where tampering is suspected to restore consistency with underlying records.

Patch Information

ArcadeDB addressed the vulnerability in version 26.9.1. The fix extends ACL enforcement into the index and TimeSeries read/write paths and filters schema:indexes results by caller permissions. Refer to the GitHub Security Advisory GHSA-2c8m-q484-jv7m for the maintainer's patch notes.

Workarounds

• Restrict network exposure of ArcadeDB endpoints to trusted application tiers only, reducing the pool of principals that can reach the vulnerable code paths.
• Remove any bound principals that do not require query access until the upgrade is complete.
• Disable transports (Bolt, Postgres, Gremlin) that are not required in production to reduce the attack surface.
• Add application-layer query filtering that rejects SQL referencing INDEX: or schema:indexes from untrusted callers.

# Verify installed ArcadeDB engine version and confirm upgrade to 26.9.1
grep -r 'arcadedb-engine' /path/to/deployment/lib/ | awk -F'-' '{print $NF}'

# Example Maven dependency pinned to the fixed release
# <dependency>
#   <groupId>com.arcadedb</groupId>
#   <artifactId>arcadedb-engine</artifactId>
#   <version>26.9.1</version>
# </dependency>