CVE-2026-67341 ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTION
Attackers with database access can execute arbitrary JavaScript code by bypassing authorization checks on SQL DEFINE FUNCTION statements.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-67341?
CVE-2026-67341 is a critical missing authorization vulnerability in ArcadeData arcadedb, published on 1 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing security controls intended to restrict scripting to administrators.
Weakness: CWE-863
Which versions are affected by CVE-2026-67341?
2 open source packages ship an affected version, including com.arcadedb:arcadedb-engine.
| Package | Affected | Fixed in |
|---|---|---|
com.arcadedb:arcadedb-engine Maven | All versions | 26.7.2 |
com.arcadedb:arcadedb-engine Maven | All versions | 26.7.2 |
How do I fix CVE-2026-67341?
Upgrade com.arcadedb:arcadedb-engine to 26.7.2 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-67341 being exploited?
There is no known exploitation of CVE-2026-67341 in the wild and no public exploit code.
Sources
Also known as GHSA-mr73-pqgp-rqp5, GHSA-vwjc-v7x7-cm6g.