CVE-2026-67342: critical vulnerability in ArcadeData arcadedb
ArcadeDB before 26.7.2 Authorization Bypass via Database Handlers
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.3epss 0.5%
ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling affected endpoints with arbitrary database parameters.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
ArcadeData · arcadedbRelated CVEs — ArcadeData arcadedb
In the same product, most dangerous first.
CVE-2026-67340HIGHArcadeDB before 26.7.2 Remote Code Execution via Trigger ScriptsEPSS 0.9%CVE-2026-75854CRITICALArcadeDB Redis Wire-Protocol Plugin Missing AuthenticationEPSS 0.9%CVE-2026-76224HIGHArcadeDB before 26.8.1 Remote Code Execution via Groovy FallbackEPSS 0.9%CVE-2026-75852CRITICALArcadeDB MongoDB wire protocol authentication bypass cross-databaseEPSS 0.7%CVE-2026-114059HIGHArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing AuthorizationEPSS 0.6%CVE-2026-93598HIGHArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundleEPSS 0.6%