CVE-2026-67340 in ArcadeDB
Summary
by MITRE • 08/01/2026
ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java.lang.* to the allowed packages. An authenticated user with UPDATE_SCHEMA permission can create a JavaScript trigger that invokes java.lang.Runtime.getRuntime().exec() (or ProcessBuilder), achieving OS command execution when the trigger fires.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
This vulnerability exists in ArcadeDB versions prior to 26.7.2 within the arcadedb-engine component where trigger scripts can access classes from the java.lang package through Java.type lookup mechanisms. The root cause lies in the ScriptTriggerExecutor implementation which automatically includes java.lang.* packages in the allowed package whitelist, creating an insecure execution environment for trigger scripts. Attackers with UPDATE_SCHEMA permissions can exploit this by crafting JavaScript triggers that reference java.lang.Runtime.getRuntime().exec() or ProcessBuilder classes directly through the Java.type API, bypassing normal security boundaries.
The technical flaw represents a classic privilege escalation vulnerability where authenticated users with schema update capabilities can escalate their privileges to achieve arbitrary operating system command execution. This occurs because the trigger execution environment permits direct Java class instantiation and method invocation without proper sandboxing or access control enforcement. The vulnerability specifically enables command injection attacks through trigger mechanisms that execute in the context of the database engine process, potentially allowing attackers to execute malicious commands with the same privileges as the database service account.
The operational impact of this vulnerability is severe and multifaceted across multiple security domains. An attacker who gains UPDATE_SCHEMA permission can establish persistent backdoors by creating triggers that spawn reverse shells or download additional malware payloads. The execution occurs at the operating system level, potentially allowing full system compromise including privilege escalation, data exfiltration, and lateral movement within the network infrastructure. This vulnerability affects database administrators who may inadvertently grant schema update permissions to untrusted users, creating a significant attack surface for privilege abuse.
Mitigation strategies must address both immediate patching requirements and architectural security improvements. Organizations should immediately upgrade to ArcadeDB version 26.7.2 or later where the vulnerable package whitelisting has been corrected. Additional defensive measures include implementing least privilege access controls for schema update permissions, regularly auditing trigger configurations, and monitoring for suspicious trigger creation activities. Network segmentation and process isolation techniques can help limit the blast radius if exploitation occurs. This vulnerability aligns with CWE-276 (Insecure Default Permissions) and CWE-78 (Improper Neutralization of Special Elements used in OS Commands), and maps to ATT&CK technique T1059.007 (Command and Scripting Interpreter: JavaScript) and T1068 (Exploitation for Privilege Escalation). Security teams should implement automated scanning tools to detect vulnerable trigger configurations and establish security awareness training for database administrators regarding the risks of overly permissive schema permissions.