External risk intelligence

ArcadeDB SQL DEFINE FUNCTION Authorization Bypass Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-67341

ArcadeDB is a multi-model database. While databases are typically deployed within internal network segments protected by firewalls, they are sometimes exposed directly or via management interfaces to the internet in specific cloud or development environments, making reachability possible but not a standard or required design pattern for general public access.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability in ArcadeDB allows unauthorized users to execute arbitrary JavaScript code by bypassing security controls for defining functions. If exploited, this could lead to significant compromise of the database's integrity and confidentiality. The primary concern is to confirm if ArcadeDB is in use and whether its scripting features are enabled and accessible to unauthorized parties.

Unauthorized users can run custom code.
Bypasses database function security controls.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker with existing database access can bypass security controls by defining custom JavaScript functions. This allows them to execute arbitrary code, potentially leading to unauthorized actions or data compromise within the database environment.

Requires database access.
Triggered by `DEFINE FUNCTION` SQL.
Leads to arbitrary JavaScript execution.

Live Threat

Current exploitation, exposure, and threat context

Attackers with database access could execute arbitrary JavaScript code when creating database functions using the `DEFINE FUNCTION` statement. This bypasses intended authorization checks, potentially affecting service behavior when supported by the advisory.

Arbitrary JavaScript code execution.
Bypassing authorization checks.
Unintended service behavior.

Operational Fix

Recommended remediation, mitigation, and detection steps

To address this critical vulnerability in ArcadeDB, ownership likely falls to the database administrators and the platform or infrastructure teams responsible for its deployment and maintenance. The initial step is to identify all instances of the affected database, ascertain their exposure and business criticality, and then pinpoint the accountable owner for planning the remediation strategy.

Database and platform teams should own this.
Verify affected database instances and exposure.
Plan and coordinate remediation with owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ArcadeDB?

ArcadeDB is a multi-model database engine designed to handle various data types, such as documents and graphs, within a single system. It is commonly used by developers to build flexible applications that require high performance and support for SQL-like query languages. Because it supports complex operations, it includes features like scripting to allow users to define custom logic directly within the database.

What does CVE-2026-67341 mean for security?

This vulnerability is an instance of Improper Authorization, classified as CWE-863. It means the software fails to verify whether a user has the appropriate permissions before allowing them to perform a restricted action. Specifically, it allows users to bypass security checks that are meant to ensure only administrators can use the DEFINE FUNCTION statement to execute custom JavaScript code.

How is the ArcadeDB vulnerability triggered?

The vulnerability is triggered when a user submits a SQL DEFINE FUNCTION statement using the JavaScript language. While it requires the attacker to have some form of database access to initiate the command, no special administrative privileges are needed to bypass the authorization check. Simply submitting the command is sufficient to execute the code; queries that do not use the DEFINE FUNCTION syntax do not invoke this specific authorization flaw.

Is my ArcadeDB instance at risk?

According to Halo Surface Signal, risk depends on how your database is deployed. While databases are typically kept behind firewalls, ArcadeDB may be reachable if it is exposed directly to the internet or via management interfaces in cloud environments. If your instance is internet-facing, it is at higher risk of unauthorized access compared to systems fully contained within secure internal network segments.

What should I do to address this issue?

Your first step is to locate all instances of ArcadeDB running in your environment. Once identified, evaluate whether these databases are accessible from outside your internal network. Coordinate with your platform and database administration teams to prioritize these instances and move forward with the necessary software updates to secure the scripting authorization logic.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.