CVE-2026-93598: ArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundle
ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 contains an incomplete deny-list in the polyglot script sandbox: com.arcadedb.query.polyglot.HostClassLookupFilter.DENIED lists java.util.ResourceBundle as a bare class name, which is matched by exact equality and therefore does not cover its subclasses, while ScriptTriggerExecutor.ALLOWEDPACKAGES permits java.util.. A user with the UPDATESCHEMA privilege (sufficient to create or alter a JavaScript trigger; no server-admin rights required) can reference java.util.PropertyResourceBundle or java.util.ListResourceBundle and invoke the inherited static ResourceBundle.getBundle(String) to read .properties resources from the application classpath, which the sandbox (IOAccess.NONE, with java.io., java.nio. and java.net. denied) is intended to make unreachable. This can disclose packaged application configuration such as database credentials and API keys; the advisory states the issue does not provide arbitrary host filesystem read or remote code execution. Fixed in 26.9.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
com.arcadedb:arcadedb-engineto a version that resolves this vulnerability.Fixed in 26.9.1 - Compensating control
If upgrading is not immediately possible, restrict users that have the UPDATE_SCHEMA privilege (able to create/alter JavaScript triggers) to prevent access to the ResourceBundle.getBundle(String) classpath resource disclosure path described for versions before 26.9.1.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an ArcadeDB account with the UPDATE_SCHEMA privilege, which is sufficient to create or alter a JavaScript trigger. Server-admin privileges are not required.
What information could be exposed?
A malicious trigger can read .properties resources packaged on the application classpath through ResourceBundle subclasses. This may disclose application configuration, including database credentials and API keys.
Does this allow arbitrary file reads or remote code execution?
No. The advisory states that the issue does not provide arbitrary host filesystem read or remote code execution; the exposure is limited to accessible classpath .properties resources.
Which deployments need remediation?
ArcadeDB engine versions through 26.8.1 are affected. Upgrade to version 26.9.1 to obtain the fix.
What can be done before upgrading?
Restrict UPDATE_SCHEMA privileges to fully trusted users, since that privilege enables creation or modification of the JavaScript triggers used for exploitation. Review existing JavaScript triggers created by accounts with this privilege.