CVE-2026-67342: ArcadeDB before 26.7.2 Authorization Bypass via Database Handlers
ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling affected endpoints with arbitrary database parameters.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ArcadeDBto a version that resolves this vulnerability.Fixed in 26.7.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67342?
CVE-2026-67342 has a critical severity rating of 9.3.
How do I fix CVE-2026-67342?
To fix CVE-2026-67342, upgrade ArcadeDB to version 26.7.2 or later.
What type of vulnerability is CVE-2026-67342?
CVE-2026-67342 is an authorization bypass vulnerability.
What versions of ArcadeDB are affected by CVE-2026-67342?
ArcadeDB versions before 26.7.2 are affected by CVE-2026-67342.
What impact does CVE-2026-67342 have on database security?
CVE-2026-67342 allows attackers to access and modify databases without proper authorization.