CVE-2026-67340

CRITICAL

ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts

Title source: cna

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-67340. PoCs published by 0xdak.

AI-analyzed exploit summary Post-authentication RCE in ArcadeDB (< 26.7.2) via JAVASCRIPT trigger-script sandbox escape. The exploit leverages a GraalVM polyglot engine misconfiguration allowing `java.lang.*` host class access, enabling `Runtime.exec()` OS command execution through crafted SQL trigger creation.

Description

ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java.lang.* to the allowed packages. An authenticated user with UPDATE_SCHEMA permission can create a JavaScript trigger that invokes java.lang.Runtime.getRuntime().exec() (or ProcessBuilder), achieving OS command execution when the trigger fires.

Exploits (1)

github WORKING POC

by 0xdak · pythonpoc

https://github.com/0xdak/CVE-2026-67340_exploit

View Code ZIP pw:eip

Post-authentication RCE in ArcadeDB (< 26.7.2) via JAVASCRIPT trigger-script sandbox escape. The exploit leverages a GraalVM polyglot engine misconfiguration allowing `java.lang.*` host class access, enabling `Runtime.exec()` OS command execution through crafted SQL trigger creation.

Classification

Working Poc 99%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: ArcadeDB versions 0 to 26.7.1

Auth required

Prerequisites: Valid ArcadeDB credentials with UPDATE_SCHEMA permission (e.g., root user) · Access to the HTTP API (default port 2480) · Target database name

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

mistral-large-3 · analyzed Aug 04, 2026 Full analysis →

References (2)

Core 2

Core References

Vendor Advisory vendor-advisory

GitHub Security Advisory (GHSA-x9f9-r4m8-9xc2)

https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-x9f9-r4m8-9xc2

Third Party Advisory third-party-advisory

VulnCheck Advisory: ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts

https://www.vulncheck.com/advisories/arcadedb-before-remote-code-execution-via-trigger-scripts

Scores

CVSS v3 9.8

EPSS 0.0052

EPSS Percentile 41.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-94

Status published

Products (2)

ArcadeData/arcadedb < 26.7.2

ArcadeData/arcadedb 26.7.2

Published Aug 01, 2026

Tracked Since Aug 01, 2026