Is CVE-2026-67356 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67356 being exploited in the wild.

How severe is CVE-2026-67356?

High severity, with a CVSS score of 8.8, published 2 August 2026.

Which products and versions are affected?

ArcadeData ArcadeDB before 26.7.3.

Is there a fix for CVE-2026-67356?

A patch was published on 2026-07-17: Version 26.7.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-67356 attacked?

It is attacked over the network.

Am I affected by CVE-2026-67356?

Check whether you run ArcadeData ArcadeDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67356: ArcadeDB JavaScript trigger privilege escalation

CVE-2026-67356 · Severity: high · CVSS 8.8 · Published 2026-08-02

ArcadeDB is a database system that allows administrators to create JavaScript triggers to automate actions on data changes. A vulnerability allows schema administrators (who have limited permissions) to create malicious triggers that execute JavaScript code with unrestricted access to internal database objects, enabling them to create server-wide admin accounts and escalate their privileges beyond their intended authorization level.

Technologies: ArcadeData ArcadeDB. Vendors: ArcadeData.

Quick answers

Is CVE-2026-67356 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67356 being exploited in the wild.
How severe is CVE-2026-67356?: High severity, with a CVSS score of 8.8, published 2 August 2026.
Which products and versions are affected?: ArcadeData ArcadeDB before 26.7.3.
Is there a fix for CVE-2026-67356?: A patch was published on 2026-07-17: Version 26.7.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-67356 attacked?: It is attacked over the network.
Am I affected by CVE-2026-67356?: Check whether you run ArcadeData ArcadeDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in ScriptTriggerExecutor, which binds the real LocalDatabase object into a GraalVM JavaScript execution context with HostAccess.ALL permissions. This allows JavaScript code in triggers to call any public method on the bound database object, including getSecurity().createUser(). The ServerSecurity.createUser() method lacks internal permission checks and grants admin privileges on all databases. An attacker with UPDATE_SCHEMA permission (which only controls trigger creation, not user management) can craft a trigger whose JavaScript calls database.getSecurity().createUser() to mint a server-wide admin account, crossing a privilege boundary that is strictly less than UPDATE_SECURITY. The attack requires network access and attacker control of trigger creation, but no user interaction.

Affected products

ArcadeData ArcadeDB before 26.7.3

Timeline

2026-07-17: disclosed
2026-07-17: patched: Version 26.7.3 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.