CVE-2026-93595 Overview
CVE-2026-93595 is an access control bypass vulnerability in ArcadeDB versions before 26.9.1. The flaw resides in the query_database tool exposed through the AI chat endpoints. The tool executes queries without binding the authenticated principal to DatabaseContext, causing per-type and per-bucket Access Control List (ACL) checks to silently no-op. Authenticated users can prompt the AI assistant to read data they are explicitly denied at the per-type level. The vulnerability is categorized as Missing Authorization [CWE-862].
Critical Impact
Authenticated attackers can retrieve sensitive records from restricted types or buckets by routing queries through the AI chat interface, bypassing controls enforced on normal query endpoints.
Affected Products
- ArcadeDB versions prior to 26.9.1
- Deployments exposing the AI chat endpoints with the query_database tool enabled
- Multi-tenant ArcadeDB instances relying on per-type or per-bucket ACLs for isolation
Discovery Timeline
- 2026-09-18 - CVE-2026-93595 published to the National Vulnerability Database (NVD)
- 2026-09-21 - Last updated in NVD database
Technical Details for CVE-2026-93595
Vulnerability Analysis
ArcadeDB enforces authorization through per-type and per-bucket ACLs evaluated against the authenticated principal stored in DatabaseContext. When a request reaches the standard query endpoints, the server binds the caller's security identity into that context before executing the query. The engine then consults ACLs during type and bucket resolution to allow or deny access to records.
The query_database tool exposed through the AI chat endpoints does not perform this binding step. Queries dispatched by the AI assistant execute without an associated principal in DatabaseContext. As a result, the ACL evaluation logic finds no identity to check against and silently returns success, effectively no-oping the authorization decision.
An authenticated user who lacks read permission on a restricted type can invoke the AI chat, instruct it to query that type, and receive rows the direct query API would reject. The vulnerability affects confidentiality of any data protected exclusively by ArcadeDB's type-level or bucket-level ACLs.
Root Cause
The root cause is a missing authorization step [CWE-862] in the AI tool integration layer. The query_database tool bypasses the code path that binds the authenticated principal to DatabaseContext, so downstream ACL checks operate without the identity required to enforce them.
Attack Vector
Exploitation requires network access to the ArcadeDB HTTP API and valid low-privilege credentials for the target database. The attacker authenticates, opens an AI chat session, and prompts the assistant to run queries that target types or buckets denied by their ACL. The AI executes the query through query_database, and results are returned in the chat response. No user interaction from a second party is required, and no additional privileges beyond a valid login are needed.
Refer to the GitHub Security Advisory and the VulnCheck Advisory on ArcadeDB for full technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-93595
Indicators of Compromise
- Requests to ArcadeDB AI chat endpoints from accounts that also generate normal query API 403 or authorization-denied errors for the same types or buckets.
- AI chat sessions where prompts reference specific type names, bucket names, or record identifiers not otherwise accessed by the authenticated user.
- Query patterns in AI chat logs that read from types explicitly restricted by ACL policy.
Detection Strategies
- Correlate AI chat query activity with the caller's effective ACL permissions and alert when the two diverge.
- Baseline each user's normal type and bucket access via the standard query API and flag AI chat access to types outside that baseline.
- Inspect ArcadeDB server logs for query_database invocations that return rows from restricted types.
Monitoring Recommendations
- Enable verbose audit logging for AI chat endpoints and forward events to a central Security Information and Event Management (SIEM) platform for correlation.
- Monitor for spikes in AI chat query volume from single accounts, which can indicate scripted enumeration of restricted types.
- Track authentication events alongside AI tool invocations to identify low-privilege accounts pulling high-sensitivity data.
How to Mitigate CVE-2026-93595
Immediate Actions Required
- Upgrade ArcadeDB to version 26.9.1 or later on all instances exposing AI chat endpoints.
- Rotate credentials for any accounts that could have accessed restricted data through the AI chat interface during the exposure window.
- Review AI chat and query logs for evidence of unauthorized access to sensitive types or buckets.
Patch Information
ArcadeDB 26.9.1 binds the authenticated principal to DatabaseContext when the query_database tool executes, restoring per-type and per-bucket ACL enforcement. Details are published in the GitHub Security Advisory GHSA-chrr-vr3p-crcc.
Workarounds
- Disable the AI chat endpoints or the query_database tool until the patched version is deployed.
- Restrict network access to AI chat endpoints to trusted administrative users only.
- Where feasible, move sensitive data out of shared databases so authenticated low-privilege users cannot reach it through any endpoint.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
