---
id: CVE-2026-65831
title: ArcadeDB is a Multi-Model DBMS
summary: >-
  ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-role user can submit
  POST /api/v1/command/{database} with language: js because
  PolyglotQueryEngine.command, PolyglotQueryEngine.analyze, and
  PolyglotQueryEngine.registerFunctions …
severity: high
cvss: 7.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'
cwe:
  - CWE-269
  - CWE-863
vendor: ArcadeData
product: arcadedb
affected:
  - arcadedb < 26.7.1
  - arcadedb-server < 26.7.1
published: '2026-09-15'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T16:17:22.387'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-65831'
references:
  - url: >-
      https://github.com/ArcadeData/arcadedb/commit/8ca396c07e471a0b97fee075eeb956b5e24a23be
    label: security-advisories@github.com
  - url: 'https://github.com/ArcadeData/arcadedb/releases/tag/26.7.1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-48qw-824m-86pr
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-15T15:38:29.299377Z'
ingestedAt: '2026-09-15T15:39:12.908Z'
epss: 0.00442
epssPercentile: 0.37709
---

## Overview

ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-role user can submit POST /api/v1/command/{database} with language: js because PolyglotQueryEngine.command, PolyglotQueryEngine.analyze, and PolyglotQueryEngine.registerFunctions do not enforce database-administrator authorization. GraalPolyglotEngine also permits scripts to bypass the allowedPackages whitelist by reflecting from the bound database object through database.getClass().getClassLoader().loadClass to arbitrary host classes. These cooperating defects allow a read-only database user to read arbitrary host files outside the database scope. Process creation is already blocked, so OS command execution is not confirmed. The issue is distinct from CVE-2026-44221, CVE-2026-54076, and CVE-2026-54077. This issue is fixed in version 26.7.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.