What’s Vulnerable › Vulnerabilities

CVE-2026-93595: ArcadeDB before 26.9.1 ACL Bypass via query_database Tool

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-18 · updated 2026-09-21
• Weakness: CWE-862

Description

ArcadeDB before 26.9.1 contains an access control bypass vulnerability in the query_database tool exposed through the AI chat endpoints. The tool executes queries without binding the authenticated principal to DatabaseContext, causing per-type and per-bucket ACL checks to silently no-op and allowing authenticated users to read data they are explicitly denied at the per-type level. Attackers can prompt the AI assistant to execute queries against restricted types or buckets to retrieve sensitive data that would be rejected through normal query endpoints.

Affected products

• ArcadeData arcadedb: before 26.9.1 — fixed in 26.9.1

How to fix

Upgrade to a fixed version: ArcadeData arcadedb 26.9.1. Check the vendor advisory for mitigations.

References

• https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-chrr-vr3p-crcc
• https://www.vulncheck.com/advisories/arcadedb-before-26.9.1-acl-bypass-via-query-database-tool

Get alerted when CVE-2026-93595 or the next vulnerability affects your stack