CVE-2026-119577 in ArcadeDB
Summary
by MITRE • 10/30/2026
ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDB, or Redis wire-protocol connections. Attackers holding an existing connection can keep reading and writing data after deletion, grant removal, or password rotation, because executors keep a stale ServerSecurityUser.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in ArcadeDB versions prior to 26.10.2 represents a critical failure in session management and access control enforcement within the database server's connection handling logic. This flaw specifically affects connections established using standard wire protocols, including Postgres, Bolt, MongoDB, and Redis. The core issue stems from how the application manages user security contexts during active sessions. When an administrator revokes a user's permissions, deletes their account, or rotates their password, the system fails to invalidate existing network sockets associated with that user. Instead of terminating these connections immediately upon detecting the change in authorization status, the server continues to service requests through them because the underlying executor retains a stale reference to the ServerSecurityUser object. This means that even though the central security registry has been updated to reflect the loss of privileges, the active connection handlers are not notified and continue operating under the assumption that the user remains authorized with their previous level of access.
From a technical perspective, this is a classic example of improper authorization due to stale session state. The vulnerability allows an attacker who possesses valid credentials for an existing connection to maintain read and write access long after those credentials should have been rendered invalid by administrative action. This behavior bypasses the intended security controls designed to restrict data access based on current user roles and permissions. In a typical secure implementation, any change in user status such as deletion or privilege revocation would trigger immediate session termination across all active connections associated with that identity. However, because ArcadeDB relies on cached security objects within the executor layer without implementing a mechanism for real-time invalidation of these caches during connection lifecycle events, the disconnect between the authorization state and the execution context persists until the connection is naturally closed by timeout or explicit client action.
The operational impact of this vulnerability is significant, particularly in environments where rapid response to compromised accounts is essential. If an attacker gains access through a legitimate user account and that account is subsequently identified as compromised, standard incident response procedures involve revoking the user's privileges immediately. Under normal circumstances, this would cut off the attacker's access instantly. However, due to this flaw, the attacker can continue exfiltrating sensitive data or modifying records even after the administrative team has taken corrective action. This creates a dangerous window of opportunity for malicious actors and undermines the integrity of security policies that rely on immediate enforcement of user status changes. It also complicates forensic analysis because activity logs may show legitimate-looking operations from an account that should no longer have had any access, making it harder to distinguish between authorized administrative actions and unauthorized exploitation attempts.
This vulnerability aligns with CWE-284 Improper Access Control, specifically the sub-category involving failure to enforce restrictions on existing connections or sessions. It also maps closely to MITRE ATT&CK technique T1078 Valid Accounts, as attackers leverage legitimate credentials that have not been properly invalidated by system administrators. Furthermore, it relates to T1530 Data from Local System Archives if the attacker uses this extended access period to copy sensitive database contents before detection occurs. The persistence of stale security contexts is a common pitfall in high-performance databases where connection pooling and caching are used for efficiency, but it requires rigorous implementation of session invalidation protocols to prevent abuse.
To mitigate this vulnerability, organizations running ArcadeDB versions prior to 26.10.2 should upgrade immediately to version 26.10.2 or later, which addresses the issue by ensuring that revoked users are disconnected from all active sessions upon privilege changes. In environments where upgrading is not immediately feasible, administrators can implement network-level controls such as firewall rules or reverse proxy configurations to forcibly terminate connections associated with compromised accounts more aggressively than the application layer allows. Additionally, implementing strict session timeout policies and monitoring for unusual activity patterns on recently modified user accounts can help detect exploitation attempts during the window of vulnerability. Regular audits of active sessions against current authorization records should also be conducted to identify any lingering stale connections that may pose a risk until the software patch is applied.