Is CVE-2026-67342 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67342 being exploited in the wild.

How severe is CVE-2026-67342?

Critical severity, with a CVSS score of 9.8, published 1 August 2026.

Which products and versions are affected?

ArcadeData ArcadeDB before 26.7.2; com.arcadedb:arcadedb-server (Maven) ECOSYSTEM:introduced=0,fixed=26.7.2.

Is there a fix for CVE-2026-67342?

Yes. com.arcadedb:arcadedb-server (Maven): upgrade to 26.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-67342 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-67342?

Check whether you run ArcadeData ArcadeDB or com.arcadedb:arcadedb-server (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67342: ArcadeDB authorization bypass in HTTP handlers

CVE-2026-67342 · Severity: critical · CVSS 9.8 · Published 2026-08-01

ArcadeDB is a multi-model database platform. Versions before 26.7.2 contain an authorization flaw in time series, batch, Prometheus, and Grafana API endpoints that fail to validate database access permissions. An attacker with access to one database can read and modify other databases they should not have access to, potentially exposing sensitive data or disrupting operations.

Technologies: ArcadeData ArcadeDB, com.arcadedb:arcadedb-server (Maven). Vendors: ArcadeData, Maven.

Quick answers

Is CVE-2026-67342 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67342 being exploited in the wild.
How severe is CVE-2026-67342?: Critical severity, with a CVSS score of 9.8, published 1 August 2026.
Which products and versions are affected?: ArcadeData ArcadeDB before 26.7.2; com.arcadedb:arcadedb-server (Maven) ECOSYSTEM:introduced=0,fixed=26.7.2.
Is there a fix for CVE-2026-67342?: Yes. com.arcadedb:arcadedb-server (Maven): upgrade to 26.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-67342 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-67342?: Check whether you run ArcadeData ArcadeDB or com.arcadedb:arcadedb-server (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

com.arcadedb:arcadedb-server (Maven): upgrade to 26.7.2 or later

# set com.arcadedb:arcadedb-server to 26.7.2 in your pom.xml or build.gradle

Technical details

This is an insecure direct object reference (IDOR) vulnerability in approximately 14 HTTP handlers that resolve a database parameter from the URL path and call getDatabase(...) without first invoking the canAccessToDatabase(...) authorization check. The affected handlers extend AbstractServerHttpHandler directly instead of DatabaseAbstractHandler, which enforces per-database authorization gates. An authenticated user authorized for database 'a' can directly access and manipulate database 'b' by calling endpoints like POST /api/v1/batch/b or POST /api/v1/ts/b/write, receiving 200 OK responses. The engine's fallback permission check in LocalDatabase.checkPermissionsOnDatabase returns early when no security context exists, providing no protection. The vulnerability was patched in version 26.7.2 by re-parenting handlers to DatabaseAbstractHandler or adding a shared authorization checkpoint.

Affected products

ArcadeData ArcadeDB before 26.7.2

Identifiers

CVE-2026-67342
GHSA-x8mg-6r4p-87pf

Timeline

2026-07-09: disclosed
2026-08-01: advisory
2026-07-09: patched: Fix available in version 26.7.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.