CVE-2026-75843

CVSS 9.9 (critical) · published 2026-08-18

ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run unrestricted JavaScript that creates server-wide administrator accounts.

Weakness: CWE-269

Source: NVD CVE-2026-75843

References

• https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-p29f-345w-4qwf
• https://www.vulncheck.com/advisories/arcadedb-before-privilege-escalation-via-grpc-transaction
• https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-p29f-345w-4qwf

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.