CVE-2026-75851

ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user, causing the scripting authorization gate to become a no-op. A user with only read access to a single database can submit an asynchronous JavaScript (language=js) command via the /api/v1/command endpoint to run code with unrestricted host access (e.g., database.getSecurity().createUser) and create a server-wide administrator, escalating to full administrative control. Fixed in 26.8.1.

• CWE-269

• https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-5j4x-3jfw-8xv3
• https://www.vulncheck.com/advisories/arcadedb-before-authentication-bypass-via-async-command
• https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-5j4x-3jfw-8xv3

Published

Aug 18, 2026

Last Modified

Aug 31, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-75844ArcadeDB versions before 26.8.1 contain a server-side reques…7.1
• CVE-2026-75845ArcadeDB versions 26.4.2 through 26.7.3 contain an authoriza…6.3
• CVE-2026-75846ArcadeDB before 26.8.1 (affected versions <= 26.7.3) contain…7.1
• CVE-2026-75847Cleartext Storage of Sensitive Information vulnerability in …5.9
• CVE-2026-7585A vulnerability was determined in Open5GS up to 2.7.7. The i…4.3
• CVE-2026-75850ArcadeDB before 26.8.1 fails to bind the authenticated princ…4.2
• CVE-2026-75852ArcadeDB versions before 26.8.1 fail to enforce SASL authent…9.8
• CVE-2026-75853ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcade…8.8
• CVE-2026-75854ArcadeDB versions before 26.8.1 contain a missing authentica…9.8
• CVE-2026-75855ArcadeDB versions before 26.8.1 fail to sanitize database na…8.7
• CVE-2026-75856CodeWhale before 0.8.64 contains a server-side request forge…8.6
• CVE-2026-75857CodeWhale versions >= 0.8.41 and < 0.8.64 contain a vulnerab…7