External risk intelligence

ArcadeDB gRPC Transaction Vulnerability Allows Unrestricted JavaScript Execution

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-75843

The vulnerability exists in a gRPC transaction executor for ArcadeDB. While databases and their associated APIs are often deployed in internal, segmented environments, gRPC services can be exposed externally in some architectures. The context does not suggest that public internet exposure is a standard or required deployment pattern for this product.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security flaw has been identified in ArcadeDB that could allow authenticated users to execute unauthorized JavaScript commands. This vulnerability could enable attackers to gain administrative privileges on the system, impacting the integrity and availability of data. The main concern is confirming relevance and exposure within our environment.

Unchecked commands could grant unauthorized admin access.
High impact if exploited; affects system integrity.
Confirm if our systems use this technology.

Attack Path

How an attacker could exploit the issue

An attacker with read access can exploit this vulnerability by sending a specially crafted gRPC request. This request targets the transaction executor, bypassing normal authorization checks for script execution. Successful exploitation allows the attacker to execute arbitrary JavaScript code, which can then be used to create new administrator accounts.

Authenticated reader access needed.
Triggered via gRPC transaction command.
Enables administrator account creation.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, authenticated readers could execute arbitrary JavaScript commands due to a failure to bind the authenticated principal on the gRPC transaction executor thread. This could lead to the creation of server-wide administrator accounts.

Server-wide administrator accounts.
Authenticated readers can execute commands.
Unrestricted JavaScript execution on server.

Operational Fix

Recommended remediation, mitigation, and detection steps

The identified vulnerability in ArcadeDB's gRPC transaction executor requires immediate attention from teams managing the database infrastructure and the applications that interact with it. The first practical step is to inventory all instances of ArcadeDB, determine their exposure (internal vs. external), and confirm which are business-critical. Subsequently, the accountable owner for each instance should be identified to plan a risk-based remediation strategy.

Database administrators and application owners should own this.
Verify affected ArcadeDB instances and their reachability.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ArcadeDB?

ArcadeDB is a multi-model database engine designed to handle various data types like graphs, documents, and key-values in a single system. It is commonly used by developers to build flexible, high-performance applications that require complex data relationships. Because it functions as a central data repository, it often manages sensitive information and system configurations.

How does CVE-2026-75843 lead to unauthorized access?

This vulnerability is an Improper Privilege Management issue. In ArcadeDB, the software fails to correctly associate a user's identity with the specific thread handling gRPC database transactions. Because this security check is skipped, an authenticated reader can bypass intended restrictions and run arbitrary JavaScript commands, potentially creating new accounts with full administrative control over the entire server.

Do I need to trigger a transaction for this bug to work?

Yes, an attacker must specifically target the gRPC transaction executor by sending a crafted request containing a transaction ID. Simply having read access to the database is not enough on its own; the malicious JavaScript must be passed through this specific communication path to exploit the lack of authorization. Standard read-only queries that do not interact with the gRPC transaction flow will not trigger this vulnerability.

Is my ArcadeDB instance at risk?

Risk depends on your deployment architecture. Halo Surface Signal notes that while databases are typically kept in internal, segmented networks, some architectures may expose gRPC services to wider network access. If your ArcadeDB gRPC interface is reachable from untrusted network segments, it is more accessible to attackers than a strictly isolated instance.

What should I do if I run ArcadeDB?

Start by identifying all instances of ArcadeDB across your infrastructure to understand where this software is running. Once you have an inventory, evaluate the network accessibility of each instance to determine if they are internet-facing or restricted to internal traffic. Finally, assign responsibility to the specific application owners for each database to ensure they can manage the risk and prepare for updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.