CVE-2026-67341: ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTION
ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing security controls intended to restrict scripting to administrators.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ArcadeDBto a version that resolves this vulnerability.Fixed in 26.7.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67341?
The severity of CVE-2026-67341 is critical with a score of 9.8.
How do I fix CVE-2026-67341?
To fix CVE-2026-67341, upgrade ArcadeDB to version 26.7.2 or later.
What vulnerability does CVE-2026-67341 describe?
CVE-2026-67341 describes an authorization bypass in ArcadeDB that allows execution of arbitrary JavaScript code.
What is the impact of CVE-2026-67341?
The impact of CVE-2026-67341 includes potential remote code execution and compromise of the database.
Who is affected by CVE-2026-67341?
Users of ArcadeDB versions prior to 26.7.2 are affected by CVE-2026-67341.