CVE-2026-93598

ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 contains an incomplete deny-list in the polyglot script sandbox: com.arcadedb.query.polyglot.HostClassLookupFilter.DENIED lists java.util.ResourceBundle as a bare class name, which is matched by exact equality and therefore does not cover its subclasses, while ScriptTriggerExecutor.ALLOWED_PACKAGES permits java.util.*. A user with the UPDATE_SCHEMA privilege (sufficient to create or alter a JavaScript trigger; no server-admin rights required) can reference java.util.PropertyResourceBundle or java.util.ListResourceBundle and invoke the inherited static ResourceBundle.getBundle(String) to read .properties resources from the application classpath, which the sandbox (IOAccess.NONE, with java.io.**, java.nio.** and java.net.** denied) is intended to make unreachable. This can disclose packaged application configuration such as database credentials and API keys; the advisory states the issue does not provide arbitrary host filesystem read or remote code execution. Fixed in 26.9.1.

• CWE-184

• https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-j57p-qmrh-v7xv
• https://www.vulncheck.com/advisories/arcadedb-before-26.9.1-classpath-credential-disclosure-via-resourcebundle

Published

Sep 18, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-93592vLLM versions before 0.28.0 fail to validate the lower bound…7.5
• CVE-2026-93593ArcadeDB before 26.9.1 fails to enforce security-group types…8.1
• CVE-2026-93594ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) throu…8.1
• CVE-2026-93595ArcadeDB before 26.9.1 contains an access control bypass vul…6.5
• CVE-2026-93596ArcadeDB before 26.9.1 (com.arcadedb:arcadedb-engine <= 26.8…4.3
• CVE-2026-93597ArcadeDB versions before 26.9.1 fail to validate IPv6 transi…7.7
• CVE-2026-93599rustls-webpki through 0.103.12 (and 0.104.0-alpha releases b…7.5
• CVE-2026-9360A security flaw has been discovered in Edimax EW-7438RPn 1.2…8.8
• CVE-2026-93600rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103…2.2
• CVE-2026-93601rustls-webpki (the Rust webpki fork used by rustls) versions…2.2
• CVE-2026-93602rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 c…4.4
• CVE-2026-93603vm2 through 3.12.0 (fixed in 3.12.1) does not correctly hand…10