CVE-2026-93598 Overview
CVE-2026-93598 is an information disclosure vulnerability in ArcadeDB, distributed via the Maven artifact com.arcadedb:arcadedb-engine, affecting versions through 26.8.1. The flaw resides in the polyglot script sandbox, where the host class deny-list com.arcadedb.query.polyglot.HostClassLookupFilter.DENIED matches java.util.ResourceBundle by exact equality. Subclasses such as java.util.PropertyResourceBundle and java.util.ListResourceBundle bypass the filter while ScriptTriggerExecutor.ALLOWED_PACKAGES still permits java.util.*. An authenticated user with the UPDATE_SCHEMA privilege can read .properties resources from the application classpath, disclosing database credentials and API keys. The issue is fixed in ArcadeDB 26.9.1.
Critical Impact
Authenticated users with schema-modification rights can read arbitrary .properties files from the application classpath, exposing packaged credentials and API keys through a JavaScript trigger.
Affected Products
- ArcadeDB Engine (com.arcadedb:arcadedb-engine) versions through 26.8.1
- Deployments exposing the polyglot script sandbox with JavaScript triggers enabled
- Applications packaging sensitive .properties configuration on the classpath
Discovery Timeline
- 2026-09-18 - CVE-2026-93598 published to NVD
- 2026-09-22 - Last updated in NVD database
Technical Details for CVE-2026-93598
Vulnerability Analysis
ArcadeDB embeds a GraalVM polyglot engine to run JavaScript triggers. The sandbox is configured with IOAccess.NONE and denies the java.io.**, java.nio.**, and java.net.** packages, which should prevent reading files. Host class access is filtered through HostClassLookupFilter.DENIED, which enumerates java.util.ResourceBundle as a literal string.
The filter check uses exact string equality rather than assignability, so java.util.PropertyResourceBundle and java.util.ListResourceBundle are not blocked. Because ScriptTriggerExecutor.ALLOWED_PACKAGES permits java.util.*, these subclasses resolve successfully inside the sandbox. Invoking the inherited static method ResourceBundle.getBundle(String) triggers the JDK's built-in classpath-based resource loading, bypassing the IO restrictions entirely. This is an incomplete deny-list weakness classified as [CWE-184].
Root Cause
The root cause is an incomplete allow-list interaction with an equality-based deny-list. The sandbox author intended to block the ResourceBundle family but only listed the base class. Java's class hierarchy allows callers to reach the same inherited functionality through concrete subclasses that were never added to DENIED.
Attack Vector
An attacker authenticates to ArcadeDB with an account holding the UPDATE_SCHEMA privilege. No server-admin rights are required. The attacker creates or alters a JavaScript trigger that references java.util.PropertyResourceBundle or java.util.ListResourceBundle and calls getBundle with the base name of a .properties file expected on the classpath. The JDK loads the resource through the classloader, and the trigger returns the parsed key-value pairs to the caller. The advisory states this vector does not enable arbitrary filesystem read outside the classpath or remote code execution.
// See the GitHub Security Advisory for full technical details and reproduction steps.
// No verified proof-of-concept code is published in this article.
Detection Methods for CVE-2026-93598
Indicators of Compromise
- JavaScript triggers containing references to java.util.PropertyResourceBundle, java.util.ListResourceBundle, or ResourceBundle.getBundle
- Unexpected CREATE TRIGGER or ALTER TRIGGER operations performed by non-admin accounts holding UPDATE_SCHEMA
- Audit records showing trigger execution returning bundle-shaped key-value output to query results
Detection Strategies
- Inspect trigger definitions in the schema for polyglot code that resolves java.util.* subclasses of ResourceBundle
- Correlate schema-modification events with subsequent script execution and outbound data transfer from the ArcadeDB process
- Baseline expected trigger authors and flag deviations, particularly triggers authored by accounts that rarely modify schema
Monitoring Recommendations
- Enable ArcadeDB audit logging for schema changes and record the identity performing each UPDATE_SCHEMA operation
- Forward ArcadeDB logs to a centralized analytics platform to search for ResourceBundle, getBundle, or PropertyResourceBundle strings in trigger bodies
- Alert on privilege grants that assign UPDATE_SCHEMA to non-administrative roles
How to Mitigate CVE-2026-93598
Immediate Actions Required
- Upgrade com.arcadedb:arcadedb-engine to version 26.9.1 or later
- Audit existing JavaScript triggers for references to ResourceBundle subclasses and remove suspicious definitions
- Rotate any credentials, API keys, or secrets packaged in .properties files on the ArcadeDB application classpath
Patch Information
ArcadeDB 26.9.1 corrects the deny-list in HostClassLookupFilter so that ResourceBundle and its subclasses are blocked. See the GitHub Security Advisory and the VulnCheck Advisory for authoritative fix details.
Workarounds
- Restrict the UPDATE_SCHEMA privilege to trusted administrators until the patch is applied
- Remove sensitive configuration such as credentials and API keys from .properties files bundled on the classpath and load them from an external secret store instead
- Disable JavaScript triggers where they are not required by the application
# Update the ArcadeDB engine dependency to the fixed version
# Maven pom.xml
# <dependency>
# <groupId>com.arcadedb</groupId>
# <artifactId>arcadedb-engine</artifactId>
# <version>26.9.1</version>
# </dependency>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.