# CVE-2026-67340: ArcadeDB trigger script arbitrary Java host class access RCE

Source: https://junglewise.ai/threats/cve-2026-67340-arcadedb-trigger-script-arbitrary-java-host-class-access-rce  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-67340 · Severity: high · CVSS 7.2 · Published 2026-08-01

ArcadeDB is a graph database platform that uses JavaScript trigger scripts to respond to database events. Due to overly permissive Java package whitelisting in the script execution environment, an authenticated database user with schema modification rights can create a trigger that executes arbitrary operating system commands when the trigger fires, leading to full server compromise.

Technologies: [ArcadeData ArcadeDB](https://junglewise.ai/threats/technologies/arcadedb), [com.arcadedb:arcadedb-engine (Maven)](https://junglewise.ai/threats/technologies/com-arcadedb-arcadedb-engine). Vendors: [ArcadeData](https://junglewise.ai/threats/vendors/arcadedata), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-67340 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67340 being exploited in the wild.

**How severe is CVE-2026-67340?** High severity, with a CVSS score of 7.2, published 1 August 2026.

**Which products and versions are affected?** ArcadeData ArcadeDB before 26.7.2; com.arcadedb:arcadedb-engine (Maven) ECOSYSTEM:introduced=0,fixed=26.7.2.

**Is there a fix for CVE-2026-67340?** Yes. com.arcadedb:arcadedb-engine (Maven): upgrade to 26.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-67340 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-67340?** Check whether you run ArcadeData ArcadeDB or com.arcadedb:arcadedb-engine (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- com.arcadedb:arcadedb-engine (Maven): upgrade to 26.7.2 or later

  ```sh
  # set com.arcadedb:arcadedb-engine to 26.7.2 in your pom.xml or build.gradle
  ```


## Technical details

The ScriptTriggerExecutor class improperly allows trigger JavaScript code to access the full java.lang.* package namespace via the Java.type() method. A user with UPDATE_SCHEMA permission can create a CREATE TRIGGER statement with embedded JavaScript that invokes java.lang.Runtime.getRuntime().exec() or java.lang.ProcessBuilder to execute OS commands. The vulnerability stems from adding java.lang.* to the allowedPackages list combined with HostAccess.ALL permissions, bypassing the reflection denylist since Java.type performs host-class lookup rather than reflection. The trigger fires automatically when database events occur, executing the attacker's payload. Fix available in version 26.7.2 which removes java.lang.* from the allowed package list.

## Affected products

- ArcadeData ArcadeDB before 26.7.2

## Identifiers

- CVE-2026-67340
- GHSA-x9f9-r4m8-9xc2

## Timeline

- 2026-07-09: disclosed: GitHub Security Advisory GHSA-x9f9-r4m8-9xc2 published
- 2026-08-01: advisory: CVE-2026-67340 published on NVD
- 2026-07-09: patched: Fix available in version 26.7.2

## References

- [https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-x9f9-r4m8-9xc2](https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-x9f9-r4m8-9xc2)
- [https://www.vulncheck.com/advisories/arcadedb-before-remote-code-execution-via-trigger-scripts](https://www.vulncheck.com/advisories/arcadedb-before-remote-code-execution-via-trigger-scripts)

## Related threats

- [ArcadeDB improper authorization in wire-protocol connections](https://junglewise.ai/threats/cve-2026-119577-arcadedb-before-26-10-2-contains-an-improper-authorization)
- [ArcadeDB authorization bypass in GraphQL schema endpoint](https://junglewise.ai/threats/cve-2026-119576-arcadedb-from-21-12-1-before-26-10-2-contains-an-authorization)
- [ArcadeDB server-side request forgery in LOAD CSV](https://junglewise.ai/threats/cve-2026-119575-arcadedb-from-26-8-1-before-26-10-2-contains-a-server-side)
- [ArcadeDB remote code execution in Gremlin Groovy engine](https://junglewise.ai/threats/cve-2026-114059-arcadedb-before-26-10-1-contains-a-remote-code-execution)
- [ArcadeDB Bolt protocol missing authorization](https://junglewise.ai/threats/cve-2026-114058-arcadedb-from-26-2-1-before-26-10-1-contains-a-missing)