CVE-2026-93596: ArcadeDB Auth Bypass Vulnerability

CVE-2026-93596 Overview

CVE-2026-93596 is an authorization bypass vulnerability [CWE-862] in ArcadeDB versions before 26.9.1 (com.arcadedb:arcadedb-engine <= 26.8.1). The flaw resides in the parallel edge-connect phase of the POST /api/v1/batch/{database} endpoint. ArcadeDB fails to propagate the authenticated principal onto DatabaseAsyncTransaction async worker threads. Because those workers execute without a bound user, LocalDatabase.checkPermissionsOnFile returns early and permits writes that per-type ACLs should block. This is an incomplete fix of GHSA-c23x-pqcj-7hfm, which only bound the principal on the HTTP handler thread.

Critical Impact

An authenticated low-privilege user can durably modify graph adjacency on protected vertex types, bypassing CREATE_RECORD and UPDATE_RECORD ACL enforcement in deployments relying on per-type or per-group access control.

Affected Products

• ArcadeDB versions prior to 26.9.1
• com.arcadedb:arcadedb-engine package versions <= 26.8.1
• Deployments enforcing per-type or per-group ACLs on vertex types

Discovery Timeline

• 2026-09-18 - CVE-2026-93596 published to NVD
• 2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-93596

Vulnerability Analysis

ArcadeDB's batch API processes graph edge-load operations across multiple worker threads when parallelFlush is enabled (the default). During the parallel edge-connect phase, the server dispatches write operations to DatabaseAsyncTransaction workers. These workers execute without the authenticated principal attached to their thread context.

When a worker attempts to write an edge record, LocalDatabase.checkPermissionsOnFile inspects the current user. Finding none, the method returns early rather than denying the operation. This early return path bypasses ACL evaluation entirely, allowing writes that per-type policies should reject.

The practical consequence is unauthorized modification of graph adjacency. An attacker with CREATE_RECORD on an edge type E but no write permissions on vertex type V can still append edges to V by writing into the <V>_out_edges and <V>_in_edges buckets. Setting parallelFlush=false forces synchronous execution on the HTTP handler thread, where the principal remains bound and ACL checks succeed.

Root Cause

The root cause is missing authorization propagation across thread boundaries [CWE-862]. The prior fix for GHSA-c23x-pqcj-7hfm bound the authenticated principal only on the HTTP request handler thread. Async worker threads spawned by the parallel edge-connect path inherit no user context, and the permission check treats an absent user as authorized rather than denied.

Attack Vector

Exploitation requires authenticated access with CREATE_RECORD on at least one edge type. The attacker submits a graph edge-load batch request to POST /api/v1/batch/{database} with the default parallelFlush=true. The batch payload references target vertices of a protected type V. Worker threads then write edge records into the <V>_out_edges and <V>_in_edges buckets without evaluating ACLs against the caller. Technical details are documented in the GitHub Security Advisory GHSA-27vw-j8qc-5h7x and the VulnCheck Advisory on ArcadeDB.

Detection Methods for CVE-2026-93596

Indicators of Compromise

• Batch API requests to POST /api/v1/batch/{database} from low-privilege accounts containing edge-load operations with parallelFlush=true.
• Unexpected records appearing in <V>_out_edges or <V>_in_edges buckets for vertex types where the acting user lacks CREATE_RECORD or UPDATE_RECORD.
• New edges attached to protected vertices without corresponding audit entries showing an authorized write on V.

Detection Strategies

• Correlate ArcadeDB HTTP access logs against the effective ACL matrix. Flag any batch request whose principal lacks write permission on the target vertex type.
• Audit graph adjacency snapshots to detect edge insertions on protected vertex types performed by users without direct write authority.
• Alert on batch requests where parallelFlush is explicitly set or defaults to true and the payload targets sensitive vertex types.

Monitoring Recommendations

• Enable verbose request logging on the ArcadeDB HTTP server, capturing the authenticated principal, request path, and JSON payload metadata.
• Ship logs to a centralized analytics platform and build queries for batch requests targeting sensitive vertex types by non-privileged roles.
• Track the version string reported by ArcadeDB instances and alert when any node is running <= 26.8.1.

How to Mitigate CVE-2026-93596

Immediate Actions Required

• Upgrade ArcadeDB to version 26.9.1 or later across all cluster nodes.
• Inventory service accounts and reduce write permissions on edge and vertex types to the minimum required.
• Review recent batch API activity for evidence of unauthorized edge insertions on protected vertex types.

Patch Information

The vendor released the fix in ArcadeDB 26.9.1, which binds the authenticated principal onto DatabaseAsyncTransaction worker threads so that LocalDatabase.checkPermissionsOnFile evaluates ACLs correctly during the parallel edge-connect phase. Update the com.arcadedb:arcadedb-engine dependency to 26.9.1 or later. See the GitHub Security Advisory GHSA-27vw-j8qc-5h7x for release details.

Workarounds

• Require clients to send parallelFlush=false on all batch requests; synchronous execution on the HTTP handler thread enforces ACLs correctly.
• Restrict access to POST /api/v1/batch/{database} at a reverse proxy or WAF for accounts that do not require batch ingest.
• Remove CREATE_RECORD on edge types from any account that should not be able to modify graph adjacency until the patch is applied.

# Configuration example: force synchronous flush on batch requests
curl -u user:password \
  -H 'Content-Type: application/json' \
  -X POST https://arcadedb.example.com/api/v1/batch/mydb \
  -d '{"parallelFlush": false, "operations": [ /* ... */ ]}'