ArcadeDB Unauthorized JavaScript Execution via gRPC Transaction

Executive Summary

CVE-2026-75843 is a privilege escalation flaw in ArcadeDB versions before 26.8.1. The vulnerability occurs in gRPC transaction handling where the system fails to bind the authenticated user's identity during transaction execution. This allows authenticated readers to bypass scripting authorization checks and execute arbitrary JavaScript commands without restrictions.

Useful 0 Not Useful 0

Detection Guidance

Check ArcadeDB server logs for unauthorized JavaScript command executions or admin user creation attempts. Monitor gRPC transaction logs for suspicious executeCommand calls with transaction IDs. Verify if any new admin accounts were created outside normal procedures.

Useful 0 Not Useful 0

Impact Analysis

An attacker with authenticated reader access could exploit this to create server-wide administrator accounts. They can run unrestricted JavaScript commands via executeCommand using a transaction ID, leading to full system compromise. The gRPC plugin is enabled by default, making the attack widely exploitable.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and control of sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. Unrestricted JavaScript execution may allow attackers to exfiltrate, modify, or delete protected health or personal data, resulting in compliance breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade ArcadeDB to version 26.8.1 or later immediately. Disable gRPC external transactions if not required. Review all admin accounts for unauthorized creation. Implement network segmentation to limit access to gRPC endpoints.

Useful 0 Not Useful 0