CVE-2026-93598: ArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundle

Severity: high (CVSS 7.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-18 · updated 2026-09-22
Weakness: CWE-184

Description

ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 contains an incomplete deny-list in the polyglot script sandbox: com.arcadedb.query.polyglot.HostClassLookupFilter.DENIED lists java.util.ResourceBundle as a bare class name, which is matched by exact equality and therefore does not cover its subclasses, while ScriptTriggerExecutor.ALLOWED_PACKAGES permits java.util.*. A user with the UPDATE_SCHEMA privilege (sufficient to create or alter a JavaScript trigger; no server-admin rights required) can reference java.util.PropertyResourceBundle or java.util.ListResourceBundle and invoke the inherited static ResourceBundle.getBundle(String) to read .properties resources from the application classpath, which the sandbox (IOAccess.NONE, with java.io.**, java.nio.** and java.net.** denied) is intended to make unreachable. This can disclose packaged application configuration such as database credentials and API keys; the advisory states the issue does not provide arbitrary host filesystem read or remote code execution. Fixed in 26.9.1.

Affected products

ArcadeData arcadedb: before 26.9.1 — fixed in 26.9.1

How to fix

Upgrade to a fixed version: ArcadeData arcadedb 26.9.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-93598 or the next vulnerability affects your stack