Live › vulnerability › CVE-2026-119576
ArcadeDB versions from 21.12.1 before 26.10.2 let a user with only read-record permission replace the shared GraphQL schema through the read-only query endpoint. That lets the attacker alter query results returned to other users, including administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 14:30 UTC. All times on this page are UTC.
Teams that run ArcadeDB 21.12.1 through 26.10.1 with users who hold read-record permission on a shared database. Exposure depends on whether untrusted or low-privilege accounts can reach the query endpoint. Deployments with only fully trusted accounts face less risk but should still upgrade.
No product ranges from the sources yet.
26.10.2/api/v1/query/{database} in access logs for requests carrying a GraphQL type definition with an @sql directive26.10.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only query endpoint. Attackers can send a GraphQL type definition with a crafted @sql directive to /api/v1/query/{database}, altering query results returned to other users including administrators.
This page as .md · .json · in your agent: get_signal("CVE-2026-119576")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.