CVE-2026-75843: ArcadeDB before 26.8.1 Privilege Escalation via gRPC Transaction
ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run unrestricted JavaScript that creates server-wide administrator accounts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ArcadeDBto a version that resolves this vulnerability.Fixed in 26.8.1 - Compensating control
Restrict network access to the ArcadeDB gRPC interface so that only clients authorized for scripting/administrative operations can reach the gRPC transaction executor (prevent authenticated readers from invoking executeCommand with a transaction ID).
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
Authenticated users with reader-level access are exposed because they can use a gRPC transaction ID to invoke executeCommand and run unrestricted JavaScript. Exploitation does not require user interaction.
Which ArcadeDB versions are affected?
The affected condition exists in ArcadeDB versions before 26.8.1. Upgrading to 26.8.1 or later removes the affected version range stated in the advisory.
What is the impact of successful exploitation?
Successful exploitation can create server-wide administrator accounts, giving the attacker high-impact control over the server. The stated impact includes confidentiality, integrity, and availability compromise.