CVE-2026-67340 is a high severity (CVSS 7.2) code injection flaw in ArcadeDB. Before version 26.7.2, trigger scripts can reach java.lang classes, so a user with UPDATE_SCHEMA permission can run operating system commands on the server. Upgrade to ArcadeDB 26.7.2 and limit who holds that permission.
What's affected
The record says ArcadeDB before 26.7.2 (the arcadedb-engine module) is affected. The GitHub advisory (GHSA-x9f9-r4m8-9xc2) lists the Maven package com.arcadedb:arcadedb-engine, affected below 26.7.2, patched in 26.7.2. The sources agree and both rate it High.
The NVD record does not list a product in its structured data, so a scanner that matches on product names may miss it. Match on the Maven coordinates instead.
The attacker must be authenticated and must hold UPDATE_SCHEMA permission. This is not an anonymous remote bug, but in many deployments schema permission is handed out widely to developers and service accounts.
How to check if you're exposed
If ArcadeDB runs as a server, check its version from the startup log or the Studio console. If it is embedded in a Java application, check the dependency tree:
mvn dependency:tree -Dincludes=com.arcadedb
Gradle users can run gradle dependencies and search for arcadedb. Then list who holds schema rights. Review users and roles in your server configuration and note every account with UPDATE_SCHEMA. Each of those accounts is, per the record, a path to command execution until you upgrade.
A quicker route for a whole project is the free in-browser dependency scan at Gold. Paste a manifest or lockfile and it matches each dependency against known CVEs, including ones pulled in indirectly.
What to do now
- Upgrade arcadedb-engine and any server distribution to 26.7.2 or later.
- Review all accounts and roles with UPDATE_SCHEMA and remove it from anyone who does not need it.
- List existing triggers in your databases and read each script for unexpected host class use.
- Run the database process as a low privilege user, in a container where possible, so command execution has limited reach.
- Rotate credentials stored on the database host if you find triggers you did not create.
Reachability analysis helps with ordering the work. Knowing whether your code actually calls the affected path tells you which services to patch first.
Why it matters
The weakness is CWE-94, improper control of code generation. The advisory explains that the trigger executor allows lookups of classes in java.lang, and that the reflection denylist does not block this lookup. A guest process restriction in the script engine limits the engine's own process API, but not a host class that the script can reach directly.
This is a sandbox design problem. Embedded script engines are safe only as far as the list of host classes they expose. One broad package grant is enough to turn a schema permission into server access. The record does not list this CVE as known exploited.
Quick check
Can an unauthenticated user exploit this?
No. The record requires an authenticated user with UPDATE_SCHEMA permission.
Why might my scanner miss it?
The NVD record has no structured product entry. Match on the Maven package com.arcadedb:arcadedb-engine.
Sources
- https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-x9f9-r4m8-9xc2
- Record: NVD entry for CVE-2026-67340 (score 7.2, HIGH)
Last reviewed: 18 October 2026.
