CVE-2026-65831 ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read
A read-only user can escalate privileges to read arbitrary host files via JavaScript injection in the command API.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-65831?
CVE-2026-65831 is a high-severity vulnerability in ArcadeData arcadedb, published on 15 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-role user can submit POST /api/v1/command/{database} with language: js because PolyglotQueryEngine.command, PolyglotQueryEngine.analyze, and PolyglotQueryEngine.registerFunctions do not enforce database-administrator authorization. GraalPolyglotEngine also permits scripts to bypass the allowedPackages whitelist by reflecting from the bound database object through database.getClass().getClassLoader().loadClass to arbitrary host classes. These cooperating defects allow a read-only database user to read arbitrary host files outside the database scope. Process creation is already blocked, so OS command execution is not confirmed. The issue is distinct from CVE-2026-44221, CVE-2026-54076, and CVE-2026-54077. This issue is fixed in version 26.7.1.
Which versions are affected by CVE-2026-65831?
2 open source packages ship an affected version, including com.arcadedb:arcadedb-server.
| Package | Affected | Fixed in |
|---|---|---|
com.arcadedb:arcadedb-server Maven | All versions | 26.7.1 |
com.arcadedb:arcadedb-server Maven | All versions | 26.7.1 |
How do I fix CVE-2026-65831?
Upgrade com.arcadedb:arcadedb-server to 26.7.1 or later.
Is CVE-2026-65831 being exploited?
There is no known exploitation of CVE-2026-65831 in the wild and no public exploit code.
Sources
Also known as GHSA-48qw-824m-86pr.