External risk intelligence

ArcadeDB Authorization Bypass in HTTP Handlers Allows Unauthorized Database Access

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-67342

The vulnerability resides in HTTP handlers for database services including monitoring and integration endpoints like Prometheus and Grafana. These services are commonly exposed or reachable via network APIs in web application and data infrastructure deployments, making the affected interface a frequent target for network-based interaction.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

ArcadeDB versions prior to 26.7.2 have a vulnerability that allows unauthorized access to and modification of databases. This occurs because certain HTTP handlers do not properly validate database permissions, enabling attackers to bypass security controls by directly calling affected endpoints with crafted parameters. The main concern is confirming relevance and exposure to this authorization bypass flaw.

Unrestricted access to databases.
Critical authorization flaw in common API endpoints.
Assess system relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could bypass authorization checks by directly accessing specific HTTP endpoints related to time series data, batch operations, and monitoring tools. By calling these endpoints with custom database parameters, an unauthorized user could gain access to and modify data within databases.

Unauthenticated network access required.
Directly calling affected HTTP endpoints.
Unauthorized database access and modification.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthorized access to databases through specific HTTP endpoints. When these endpoints are accessible externally, an attacker could bypass authentication and authorization checks to view or modify sensitive data. The risk is highest when these endpoints are exposed without proper network segmentation or additional access controls.

Database data and services.
Unauthenticated network access.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

The ArcadeDB authorization bypass in HTTP handlers requires immediate attention from application owners and infrastructure teams responsible for database deployments. The first critical step is to identify all instances of affected ArcadeDB deployments, assess their network exposure, and determine their business criticality to prioritize remediation efforts.

Identify affected deployments and owners.
Verify network exposure and criticality.
Plan and execute remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ArcadeDB?

ArcadeDB is a multi-model database engine designed to handle graph, document, key-value, and time-series data. It is often used by developers building data-intensive applications that require flexible schema handling and high-performance querying, frequently integrating with monitoring and visualization tools to manage database health and performance metrics.

How does CVE-2026-67342 work?

This vulnerability is an authorization bypass, classified as CWE-639. It happens when the software fails to verify who you are before granting access to specific operations. In this case, the HTTP handlers for features like Prometheus, Grafana, and batch processing do not check if a user is permitted to interact with the database they are requesting. By sending a specially crafted request, an unauthorized person can trick the system into performing actions on databases they should not see.

What triggers this vulnerability?

An attacker triggers this by sending a direct HTTP request to specific vulnerable API endpoints, including those used for time series or monitoring integration. They can then specify the name of any database as a parameter in the request. Importantly, simply having the software installed is not enough; the bug is only activated when an attacker actively sends these unauthorized requests to the target endpoints.

Is my system at risk?

According to Halo Surface Signal, this vulnerability is particularly relevant if your ArcadeDB instance is reachable via network APIs. Because the affected endpoints—such as those for Prometheus and Grafana integration—are often exposed to support monitoring and external connectivity, they become frequent targets. If your deployment is exposed to untrusted networks, the risk of unauthorized database access is higher compared to services restricted to internal, isolated environments.

When should I take action?

You should prioritize this immediately if your databases are reachable over a network. Your first step is to locate all instances of ArcadeDB in your environment to determine which are running versions prior to 26.7.2. After identifying these assets, assess their network exposure and business impact to plan your update. Blocking unauthorized access at the network layer is a vital interim measure while you prepare to update the software to the patched version.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.