CVE-2026-67342 in ArcadeDB
Summary
by MITRE • 08/01/2026
ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling affected endpoints with arbitrary database parameters.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
This vulnerability represents a critical authorization bypass flaw affecting ArcadeDB versions prior to 26.7.2 where HTTP handlers for time series, batch, Prometheus, and Grafana endpoints lack proper database access permission validation. The technical implementation fails to enforce authentication checks when processing requests through these specific API endpoints, creating a pathway for unauthorized users to manipulate database resources they should not have access to. This weakness directly violates fundamental security principles of least privilege and access control enforcement that are essential for protecting database systems from unauthorized modifications.
The operational impact of this vulnerability extends beyond simple data exposure to encompass full database manipulation capabilities including read, write, update, and delete operations across affected endpoints. Attackers can exploit this flaw by crafting direct HTTP requests targeting the vulnerable time series, batch processing, Prometheus monitoring, and Grafana integration interfaces with arbitrary database parameters. This allows malicious actors to access confidential information stored in databases, modify critical data structures, and potentially execute destructive operations that could compromise system integrity and availability.
From a cybersecurity framework perspective, this vulnerability maps directly to CWE-863 - "Authorization Bypass Through User-Controlled Key" and aligns with ATT&CK technique T1078 - "Valid Accounts" where unauthorized access is achieved through legitimate authentication mechanisms. The flaw demonstrates poor input validation and access control implementation in the web application layer, specifically within the HTTP handler components that process time series data requests and monitoring integration calls. Organizations using ArcadeDB in production environments face significant risk exposure particularly when these endpoints are accessible over network boundaries without additional security controls.
The remediation approach requires immediate patching to ArcadeDB version 26.7.2 or later where proper access control validation has been implemented for all affected HTTP handlers. Security administrators should also consider implementing additional network-level controls such as firewall rules restricting access to these specific endpoints, authentication requirements for monitoring interfaces, and regular security audits of database access patterns. Organizations should conduct comprehensive vulnerability assessments across all ArcadeDB installations and implement monitoring solutions to detect unauthorized access attempts to time series and batch processing endpoints that could indicate exploitation of this vulnerability.