Is CVE-2026-93594 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93594 being exploited in the wild.

How severe is CVE-2026-93594?

High severity, with a CVSS score of 8.1, published 18 September 2026.

Which products and versions are affected?

ArcadeData ArcadeDB through 26.8.1.

Is there a fix for CVE-2026-93594?

A patch was published on 2026-09-03: Fixed in version 26.9.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-93594 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-93594?

Check whether you run ArcadeData ArcadeDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93594: ArcadeDB access-control bypass via index and TimeSeries engine

CVE-2026-93594 · Severity: high · CVSS 8.1 · Published 2026-09-18

ArcadeDB is a database engine used for storing and querying graph, document, and relational data. The vulnerability allows authenticated users to bypass per-type access controls and read restricted data (including sensitive field values, record IDs, counts, and TimeSeries samples) and corrupt indexes—despite being denied permission to access those data types. This could expose confidential customer information or business metrics that should be restricted based on user roles.

Technologies: ArcadeData ArcadeDB. Vendors: ArcadeData.

Quick answers

Is CVE-2026-93594 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93594 being exploited in the wild.
How severe is CVE-2026-93594?: High severity, with a CVSS score of 8.1, published 18 September 2026.
Which products and versions are affected?: ArcadeData ArcadeDB through 26.8.1.
Is there a fix for CVE-2026-93594?: A patch was published on 2026-09-03: Fixed in version 26.9.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-93594 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-93594?: Check whether you run ArcadeData ArcadeDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

ArcadeDB enforces per-type access-control rules exclusively in the LocalBucket component, keyed on file ID. However, query-execution paths that access record data through LSM index files or the TimeSeries engine bypass this permission check entirely, leaving five distinct attack surfaces: (1) reading indexed field values and record IDs via INDEX: queries, (2) deleting index entries to desynchronize indexes and violate unique constraints, (3) reading MIN/MAX values through index shortcuts, (4) reading and counting TimeSeries samples, and (5) disclosing record counts via index queries. The attack requires only a valid authenticated account with any database access; index and type names are discoverable via unfiltered schema queries. The vulnerability affects all deployment modes (embedded and server) and all transports (HTTP, Bolt, Postgres, Gremlin). Patches are available in version 26.9.1.

Affected products

ArcadeData ArcadeDB through 26.8.1

Timeline

2026-09-18: disclosed
2026-09-03: patched: Fixed in version 26.9.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.