Critical ArangoDB Flaws Allow Authentication Bypass and Remote Code Execution as Root
Two critical ArangoDB flaws (CVSS 9.8 and 9.9) enable unauthenticated API access and root code execution; fixes shipped in version 3.12.11
Remedio researchers found two ArangoDB flaws: GHSA-rrgq-978q-36mq (CVSS 9.8), an authentication bypass caused by the server inconsistently interpreting URL-encoded '/_api' paths, and GHSA-rvhw-4hpw-9vrx (CVSS 9.9), which lets users with database write access run JavaScript tasks with root privileges via the isSystem flag. Chained, they allow administrative database access without credentials, theft of the root password hash, and root code execution, exposing files such as /etc/shadow, TLS keys and cluster signing material on the official container image. ArangoDB shipped fixes in version 3.12.11 on August 31, 2026, with advisories published September 6; CVE identifiers were still pending. Users on 3.12.10.1 or earlier should upgrade, restrict exposure and rotate potentially exposed credentials.
- GHSA-rrgq-978q-36mq (CVSS 9.8): URL-encoding the underscore in /_api bypasses authentication entirely
- GHSA-rvhw-4hpw-9vrx (CVSS 9.9): isSystem flag grants root-context JavaScript task execution
- Chained flaws enable credential hash theft and root RCE exposing /etc/shadow and TLS keys
- Fixed in ArangoDB 3.12.11 on August 31; users on 3.12.10.1 or earlier should upgrade
From the original article
3 min read at cybersecuritynews.com
Two critical flaws in ArangoDB can let an outsider bypass login controls, read or alter database data, and then gain root-level code execution on the underlying host. The issues affect installations through version 3. 12.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.