Is CVE-2026-93598 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93598 being exploited in the wild.

How severe is CVE-2026-93598?

Informational severity, with a CVSS score of 7.1, published 18 September 2026.

Which products and versions are affected?

ArcadeData ArcadeDB through 26.8.1.

Is there a fix for CVE-2026-93598?

A patch was published on 2026-09-18: Fixed in version 26.9.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-93598 attacked?

It is attacked over the network.

Am I affected by CVE-2026-93598?

Check whether you run ArcadeData ArcadeDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93598: ArcadeDB incomplete deny-list in polyglot script sandbox

CVE-2026-93598 · Severity: info · CVSS 7.1 · Published 2026-09-18

ArcadeDB is a database platform that allows users to create JavaScript triggers for automation. A flaw in the security sandbox that runs these triggers allows a user with schema-update permissions to bypass access restrictions and read sensitive application configuration files (such as database credentials and API keys) that are packaged with the application. This exposes secrets that should be protected from script access.

Technologies: ArcadeData ArcadeDB. Vendors: ArcadeData.

Quick answers

Is CVE-2026-93598 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93598 being exploited in the wild.
How severe is CVE-2026-93598?: Informational severity, with a CVSS score of 7.1, published 18 September 2026.
Which products and versions are affected?: ArcadeData ArcadeDB through 26.8.1.
Is there a fix for CVE-2026-93598?: A patch was published on 2026-09-18: Fixed in version 26.9.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-93598 attacked?: It is attacked over the network.
Am I affected by CVE-2026-93598?: Check whether you run ArcadeData ArcadeDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an incomplete deny-list (CWE-184) in HostClassLookupFilter that blocks java.util.ResourceBundle by exact class name match, but does not block its public subclasses java.util.PropertyResourceBundle and java.util.ListResourceBundle. These subclasses are permitted by the allow-list entry "java.util.*" and inherit the static getBundle() method from ResourceBundle. An authenticated user with UPDATE_SCHEMA privilege (required only to create/alter a JavaScript trigger, not server-admin rights) can instantiate these subclasses and invoke getBundle() to read .properties resources from the application classpath, bypassing the intended IOAccess.NONE sandbox restrictions on java.io, java.nio, and java.net. The attack requires only a single line of JavaScript in a trigger. No arbitrary filesystem read or RCE is possible; impact is limited to classpath resources.

Affected products

ArcadeData ArcadeDB through 26.8.1

Timeline

2026-09-18: disclosed
2026-09-18: patched: Fixed in version 26.9.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.