Quick answers
- Is CVE-2026-119576 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-119576 being exploited in the wild.
- How severe is CVE-2026-119576?
- Medium severity, with a CVSS score of 4.3, published 30 October 2026.
- Which products and versions are affected?
- ArcadeData ArcadeDB 21.12.1 to 26.10.1.
- Is there a fix for CVE-2026-119576?
- Yes: fixed in 26.10.2. Until then: Upgrade to version 26.10.2 or later. On earlier versions, restrict GraphQL exposure to only trusted users who are permitted to alter the schema, or disable the GraphQL module entirely if not required. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-119576 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-119576?
- Check whether you run ArcadeData ArcadeDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 26.10.2
Upgrade to version 26.10.2 or later. On earlier versions, restrict GraphQL exposure to only trusted users who are permitted to alter the schema, or disable the GraphQL module entirely if not required.
Technical details
A low-privilege user holding only readRecord permissions can send a GraphQL type definition with a crafted @sql directive to the read-only /api/v1/query/{database} endpoint, bypassing the authorization check that normally requires updateSchema rights to modify the schema. When other users execute subsequent GraphQL queries, they receive results defined by the attacker's injected @sql statement rather than legitimate data. The vulnerability affects arcadedb-graphql versions 21.12.1 through 26.10.1 and is fixed in 26.10.2.
Affected products
- ArcadeData ArcadeDB 21.12.1 to 26.10.1
Timeline
- 2026-10-15: disclosed
- 2026-10-30: advisory