CVE-2026-65831

ArcadeDB versions before 26.7.1 allow a low-privileged, reader-role database user to execute JavaScript against the server by sending POST /api/v1/command/{database} with language set to js, because PolyglotQueryEngine.command, analyze, and registerFunctions fail to require database-administrator authorization for polyglot commands. A second flaw in GraalPolyglotEngine lets such scripts escape the allowedPackages whitelist by reflecting from the bound database object (database.getClass().getClassLoader().loadClass) to load arbitrary host classes. The combined effect is that a read-only user can read arbitrary files on the host outside the database scope, though process creation is already blocked and OS command execution is not confirmed. Any deployment of ArcadeDB prior to 26.7.1 that exposes the HTTP API to untrusted or low-privilege users is affected; the issue is distinct from CVE-2026-44221, CVE-2026-54076, and CVE-2026-54077. No public proof of concept or exploitation in the wild is known, and the flaw is not on the CISA KEV list.

What to do: Upgrade ArcadeDB to version 26.7.1 or later, which fixes both the missing authorization check and the classloader reflection bypass. If upgrade is not immediately possible, restrict HTTP API access (especially POST /api/v1/command) to trusted administrators only and avoid provisioning reader-role accounts to untrusted users. Review server logs for low-privilege accounts submitting commands with language js, and investigate any evidence of unexpected host file access.