CVE-2026-67342: ArcadeDB before 26.7.2 Authorization Bypass via Database Handlers

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-01 · updated 2026-10-23
Weakness: CWE-639

Description

ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling affected endpoints with arbitrary database parameters.

Affected products

ArcadeData arcadedb: before 26.7.2 — fixed in 26.7.2

How to fix

Upgrade to a fixed version: ArcadeData arcadedb 26.7.2. Check the vendor advisory for mitigations.

References

https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-x8mg-6r4p-87pf
https://www.vulncheck.com/advisories/arcadedb-before-authorization-bypass-via-database-handlers

Get alerted when CVE-2026-67342 or the next vulnerability affects your stack