CVE-2026-75851: ArcadeDB before 26.8.1 Authentication Bypass via Async Command
ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user, causing the scripting authorization gate to become a no-op. A user with only read access to a single database can submit an asynchronous JavaScript (language=js) command via the /api/v1/command endpoint to run code with unrestricted host access (e.g., database.getSecurity().createUser) and create a server-wide administrator, escalating to full administrative control. Fixed in 26.8.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
com.arcadedb:arcadedb-serverto a version that resolves this vulnerability.Fixed in 26.8.1 - Compensating control
Mitigate by avoiding asynchronous command execution via /api/v1/command with awaitResponse:false until the server is upgraded to 26.8.1.
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
Any ArcadeDB server running version 26.7.3 or earlier is affected if a user has read access to at least one database and can submit commands to the HTTP /api/v1/command endpoint. The issue enables that low-privileged user to escalate to server-wide administrative control.
What conditions are required for exploitation?
The attacker needs valid credentials for a user with read access to a single database. They submit a JavaScript command with language=js and awaitResponse:false, causing it to run on an asynchronous worker without the authenticated principal bound to its DatabaseContext.
What is the available remediation?
Upgrade ArcadeDB server to version 26.8.1, which fixes the issue. The provided information does not identify a temporary mitigation for systems that cannot be upgraded.
How can I investigate possible exploitation?
Review requests to /api/v1/command for asynchronous submissions using awaitResponse:false, particularly those specifying language=js. Also investigate unexpected server-wide administrator accounts, as the described exploit can create one through database.getSecurity().createUser.