External risk intelligence

ArcadeDB Trigger Script OS Command Execution

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-67340

ArcadeDB is a database engine typically deployed as an internal backend service or part of an application stack. While it may be network-reachable, it is generally not intended to be exposed directly to the public internet, and the requirement for authenticated access with specific schema permissions further limits the likelihood of exposure via common public-facing deployment patterns.

Code Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in ArcadeDB, a database technology, that could allow unauthorized execution of operating system commands. The issue arises from how trigger scripts handle lookups, enabling an authenticated user to potentially compromise the underlying server when a trigger is activated. The primary concern is confirming whether this specific technology is in use and identifying any exposure points.

Database commands can be run by attackers.
Critical database flaw impacts servers directly.
Assess if this database is in use.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by creating a JavaScript trigger script that leverages Java's ability to execute system commands. This script is executed when a specific database operation occurs, allowing the attacker to run arbitrary code on the server.

Requires authenticated user with schema update permission.
Trigger script execution on schema update.
Achieves OS command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary operating system commands on the server when a JavaScript trigger is invoked. This is possible because the trigger script execution environment improperly permits access to sensitive Java classes, enabling the creation of malicious commands that are then run by the server.

Server OS command execution.
Trigger script invocation.
Compromise of server environment.

Operational Fix

Recommended remediation, mitigation, and detection steps

Database and platform teams are likely responsible for addressing this vulnerability, as it impacts the ArcadeDB engine. The initial priority should be to identify all instances of the affected technology, confirm their reachability and business criticality, and then assign an owner for remediation planning.

Identify and assign ownership for affected systems.
Verify system reachability and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ArcadeDB?

ArcadeDB is a multi-model database engine designed to handle various data types, such as graphs, documents, and key-value pairs, within a single system. It is commonly used as a backend service for applications that require flexible data modeling and high performance, often integrated into larger software stacks rather than serving as a public-facing web service.

What is the vulnerability in CVE-2026-67340?

This issue is classified as CWE-94: Improper Control of Generation of Code. In ArcadeDB, the script execution environment inadvertently allows access to sensitive Java language classes. Because the system permits these lookups, a user can craft a script that calls system-level functions, resulting in unauthorized command execution on the server hosting the database.

How does an attacker trigger this flaw?

An attacker must hold UPDATE_SCHEMA permissions to create or modify a JavaScript trigger script within the database. Once the malicious trigger is saved, the OS command execution occurs automatically when that specific trigger is invoked by a database operation. Simply having access to the database without schema-level write privileges is insufficient to activate the vulnerability.

Is my instance affected by this vulnerability?

Halo Surface Signal indicates that while ArcadeDB instances may be reachable over a network, they are typically deployed as internal backend services. Because this vulnerability requires specific authenticated permissions, systems not exposed to untrusted users or those kept within secure, internal network segments have a lower immediate risk profile than those with broader access.

What should I do to respond to CVE-2026-67340?

Begin by inventorying your environment to locate all running ArcadeDB instances. Once identified, evaluate the access controls currently in place, focusing on accounts with schema modification privileges. Coordinate with your platform teams to confirm if your version is prior to 26.7.2 and prioritize applying the necessary engine updates provided by the vendor.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.