# ArcadeData ArcadeDB vulnerabilities Source: https://junglewise.ai/threats/technologies/arcadedb Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 10 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/arcadedb.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 36 vulnerabilities in ArcadeData ArcadeDB: 0 in the last 7 days and 27 in the last 90 days, 7 of them critical and 0 exploited in the wild. The most recent, CVE-2026-119577, was published on 30 October 2026. 7 vulnerabilities in the last four weeks, level on the four before (7). ## Counts - Last 7 days: 0 - Last 30 days: 7 - Last 90 days: 27 - All time: 36 (7 critical, 0 exploited in the wild) ## About ArcadeData ArcadeDB Multi-model database engine supporting graph, document, and relational data in a single unified system. ## Latest ArcadeData ArcadeDB vulnerabilities - [CVE-2026-119577: ArcadeDB improper authorization in wire-protocol connections](https://junglewise.ai/threats/cve-2026-119577-arcadedb-before-26-10-2-contains-an-improper-authorization) (medium, CVSS 6.8, published 30 Oct 2026) - [CVE-2026-119576: ArcadeDB authorization bypass in GraphQL schema endpoint](https://junglewise.ai/threats/cve-2026-119576-arcadedb-from-21-12-1-before-26-10-2-contains-an-authorization) (medium, CVSS 4.3, published 30 Oct 2026) - [CVE-2026-119575: ArcadeDB server-side request forgery in LOAD CSV](https://junglewise.ai/threats/cve-2026-119575-arcadedb-from-26-8-1-before-26-10-2-contains-a-server-side) (medium, CVSS 6.5, published 30 Oct 2026) - [CVE-2026-114059: ArcadeDB remote code execution in Gremlin Groovy engine](https://junglewise.ai/threats/cve-2026-114059-arcadedb-before-26-10-1-contains-a-remote-code-execution) (high, CVSS 7.5, published 21 Oct 2026) - [CVE-2026-114058: ArcadeDB Bolt protocol missing authorization](https://junglewise.ai/threats/cve-2026-114058-arcadedb-from-26-2-1-before-26-10-1-contains-a-missing) (medium, CVSS 4.3, published 21 Oct 2026) - [CVE-2026-114057: ArcadeDB missing authorization in Bolt protocol handler](https://junglewise.ai/threats/cve-2026-114057-arcadedb-from-26-2-1-before-26-10-1-contains-a-missing) (medium, CVSS 4.3, published 21 Oct 2026) - [CVE-2026-114056: ArcadeDB authorization bypass in ALTER TYPE edge schema](https://junglewise.ai/threats/cve-2026-114056-arcadedb-from-26-8-1-before-26-10-1-contains-an-authorization) (medium, CVSS 4.3, published 21 Oct 2026) - [CVE-2026-93598: ArcadeDB incomplete deny-list in polyglot script sandbox](https://junglewise.ai/threats/cve-2026-93598-arcadedb-incomplete-deny-list-in-polyglot-script-sandbox) (info, CVSS 7.1, published 18 Sep 2026) - [CVE-2026-93597: ArcadeDB SSRF bypass via IPv6 transition address validation](https://junglewise.ai/threats/cve-2026-93597-arcadedb-ssrf-bypass-via-ipv6-transition-address-validation) (high, CVSS 7.7, published 18 Sep 2026) - [CVE-2026-93596: ArcadeDB authorization bypass in batch edge-connect async workers](https://junglewise.ai/threats/cve-2026-93596-arcadedb-authorization-bypass-in-batch-edge-connect-async-workers) (medium, CVSS 4.3, published 18 Sep 2026) - [CVE-2026-93595: ArcadeDB AI chat query_database tool access control bypass](https://junglewise.ai/threats/cve-2026-93595-arcadedb-ai-chat-query-database-tool-access-control-bypass) (medium, CVSS 6.5, published 18 Sep 2026) - [CVE-2026-93594: ArcadeDB access-control bypass via index and TimeSeries engine](https://junglewise.ai/threats/cve-2026-93594-arcadedb-access-control-bypass-via-index-and-timeseries-engine) (high, CVSS 8.1, published 18 Sep 2026) - [CVE-2026-93593: ArcadeDB TimeSeries types ACL bypass](https://junglewise.ai/threats/cve-2026-93593-arcadedb-timeseries-types-acl-bypass) (high, CVSS 8.1, published 18 Sep 2026) - [CVE-2026-65831: ArcadeDB privilege escalation in polyglot scripting engine](https://junglewise.ai/threats/cve-2026-65831-arcadedb-privilege-escalation-in-polyglot-scripting-engine) (high, CVSS 7.7, published 15 Sep 2026) - [CVE-2026-75855: ArcadeDB path traversal in create/drop database commands](https://junglewise.ai/threats/cve-2026-75855-arcadedb-path-traversal-in-create-drop-database-commands) (high, CVSS 8.7, published 18 Aug 2026) - [CVE-2026-75854: ArcadeDB Redis wire-protocol plugin authentication bypass](https://junglewise.ai/threats/cve-2026-75854-arcadedb-redis-wire-protocol-plugin-authentication-bypass) (critical, CVSS 9.8, published 18 Aug 2026) - [CVE-2026-75852: ArcadeDB MongoDB wire protocol authentication bypass](https://junglewise.ai/threats/cve-2026-75852-arcadedb-mongodb-wire-protocol-authentication-bypass) (critical, CVSS 9.8, published 18 Aug 2026) - [CVE-2026-75851: ArcadeDB server privilege escalation in async command execution](https://junglewise.ai/threats/cve-2026-75851-arcadedb-server-privilege-escalation-in-async-command-execution) (critical, CVSS 9.9, published 18 Aug 2026) - [CVE-2026-75850: ArcadeDB authentication bypass in batch/time-series HTTP handlers](https://junglewise.ai/threats/cve-2026-75850-arcadedb-authentication-bypass-in-batch-time-series-http-handlers) (medium, CVSS 4.2, published 18 Aug 2026) - [CVE-2026-75846: ArcadeDB missing authorization in DELETE FUNCTION](https://junglewise.ai/threats/cve-2026-75846-arcadedb-missing-authorization-in-delete-function) (high, CVSS 7.1, published 18 Aug 2026) - [CVE-2026-75845: ArcadeDB authorization bypass in set_server_setting](https://junglewise.ai/threats/cve-2026-75845-arcadedb-authorization-bypass-in-set-server-setting) (medium, CVSS 6.3, published 18 Aug 2026) - [CVE-2026-75844: ArcadeDB server-side request forgery in IMPORT DATABASE](https://junglewise.ai/threats/cve-2026-75844-arcadedb-server-side-request-forgery-in-import-database) (high, CVSS 7.1, published 18 Aug 2026) - [CVE-2026-75843: ArcadeDB gRPC transaction privilege escalation via authentication bypass](https://junglewise.ai/threats/cve-2026-75843-arcadedb-grpc-transaction-privilege-escalation-via-authentication) (critical, CVSS 9.9, published 18 Aug 2026) - [CVE-2026-75842: ArcadeDB arbitrary file read in OpenCypher LOAD CSV](https://junglewise.ai/threats/cve-2026-75842-arcadedb-arbitrary-file-read-in-opencypher-load-csv) (high, CVSS 7.7, published 18 Aug 2026) - [CVE-2026-75841: ArcadeDB Cypher range() denial of service via heap exhaustion](https://junglewise.ai/threats/cve-2026-75841-arcadedb-cypher-range-denial-of-service-via-heap-exhaustion) (medium, CVSS 4.3, published 18 Aug 2026) ## Most severe ArcadeData ArcadeDB vulnerabilities - [CVE-2026-75851: ArcadeDB server privilege escalation in async command execution](https://junglewise.ai/threats/cve-2026-75851-arcadedb-server-privilege-escalation-in-async-command-execution) (critical, CVSS 9.9, published 18 Aug 2026) - [CVE-2026-75843: ArcadeDB gRPC transaction privilege escalation via authentication bypass](https://junglewise.ai/threats/cve-2026-75843-arcadedb-grpc-transaction-privilege-escalation-via-authentication) (critical, CVSS 9.9, published 18 Aug 2026) - [CVE-2026-75854: ArcadeDB Redis wire-protocol plugin authentication bypass](https://junglewise.ai/threats/cve-2026-75854-arcadedb-redis-wire-protocol-plugin-authentication-bypass) (critical, CVSS 9.8, published 18 Aug 2026) - [CVE-2026-75852: ArcadeDB MongoDB wire protocol authentication bypass](https://junglewise.ai/threats/cve-2026-75852-arcadedb-mongodb-wire-protocol-authentication-bypass) (critical, CVSS 9.8, published 18 Aug 2026) - [CVE-2026-67342: ArcadeDB authorization bypass in HTTP handlers](https://junglewise.ai/threats/cve-2026-67342-arcadedb-authorization-bypass-in-http-handlers) (critical, CVSS 9.8, published 1 Aug 2026) - [CVE-2026-67341: ArcadeDB authorization bypass in DEFINE FUNCTION](https://junglewise.ai/threats/cve-2026-67341-arcadedb-authorization-bypass-in-define-function) (critical, CVSS 9.8, published 1 Aug 2026) - [CVE-2026-44221: ArcadeData ArcadeDB authorization bypass in arcadedb-server](https://junglewise.ai/threats/cve-2026-44221-arcadedata-arcadedb-authorization-bypass-in-arcadedb-server) (critical, CVSS 9, published 12 May 2026) - [CVE-2026-67343: ArcadeDB cluster token disclosure in GET /api/v1/server](https://junglewise.ai/threats/cve-2026-67343-arcadedb-cluster-token-disclosure-in-get-api-v1-server) (high, CVSS 8.8, published 1 Aug 2026) - [CVE-2026-67356: ArcadeDB JavaScript trigger privilege escalation](https://junglewise.ai/threats/cve-2026-67356-arcadedb-javascript-trigger-privilege-escalation) (high, CVSS 8.8, published 2 Aug 2026) - [CVE-2026-75855: ArcadeDB path traversal in create/drop database commands](https://junglewise.ai/threats/cve-2026-75855-arcadedb-path-traversal-in-create-drop-database-commands) (high, CVSS 8.7, published 18 Aug 2026) ## Vulnerabilities per week 7 vulnerabilities in the last four weeks, level on the four before (7). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 13 | 4 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 7 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 4 | 0 | 0 | | 26 Oct 2026 | 3 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "ArcadeData ArcadeDB vulnerabilities", https://junglewise.ai/threats/technologies/arcadedb, 10 November 2026.