Critical ArangoDB Flaws Chain to Unauthenticated Database Access and Root RCE; Fixed in 3.12.11

Two critical ArangoDB vulnerabilities — GHSA-rrgq-978q-36mq (CVSS 9.8) and GHSA-rvhw-4hpw-9vrx (CVSS 9.9) — chain to unauthenticated database access, theft of the root password hash, and root-level code execution; fixes shipped in ArangoDB 3.12.11 on August…

Remedio researchers disclosed two critical flaws in ArangoDB on August 23, 2026 (per GBHackers). The first, GHSA-rrgq-978q-36mq (CVSS 9.8), is an authentication bypass: URL-encoding the underscore in /_api request paths (%5f) causes the server to bypass its auth prefix check, exposing protected /_api endpoints without credentials. The second, GHSA-rvhw-4hpw-9vrx (CVSS 9.9), lets JavaScript tasks run in the internal context via the isSystem flag, enabling file access, SSRF, and — when arangod runs as root, such as in the official container image — root-level code execution. The sources differ slightly on prerequisites for the second flaw: Cyber Security News describes it as exploitable by users with database write access, while GBHackers describes the isSystem flag as client-controlled without stating that requirement. Chained, the flaws yield administrative database access without credentials, theft of the root password hash, and root code execution, exposing files such as /etc/shadow, TLS keys, and cluster signing material (per Cyber Security News) in affected deployments. ArangoDB shipped fixes in 3.12.11 on August 31, 2026; GitHub Security Advisories were published September 6, 2026, and CVE identifiers were pending at disclosure time. Users on 3.12.10.1 or earlier should upgrade, restrict exposure, and rotate potentially exposed credentials; defenders can hunt for %5fapi requests and unexpected scheduled tasks with isSystem set to true.

• GHSA-rrgq-978q-36mq (CVSS 9.8): authentication bypass — a URL-encoded underscore (%5f) in /_api request paths bypasses the auth prefix check, exposing protected /_api endpoints without credentials.
• GHSA-rvhw-4hpw-9vrx (CVSS 9.9): the isSystem flag allows JavaScript task execution in the internal context, enabling file access, SSRF, and root RCE when arangod runs as root, as in the official container image.
• Prerequisite discrepancy: Cyber Security News says the task-execution flaw requires database write access; GBHackers describes the isSystem flag as client-controlled without stating that requirement.
• Chained impact: unauthenticated administrative database access, theft of the root password hash, exposure of /etc/shadow, and — per Cyber Security News — TLS keys and cluster signing material, plus root-level code execution.
• Fixed in ArangoDB 3.12.11, shipped August 31, 2026; GitHub Security Advisories published September 6, 2026; CVE identifiers were pending at disclosure time.
• Users on ArangoDB 3.12.10.1 or earlier should upgrade; remediation also includes restricting exposure and rotating potentially exposed credentials.
• Detection indicators: hunt for %5fapi requests and unexpected scheduled tasks with isSystem set to true.
• Flaws reported by Remedio researchers; GBHackers dates the disclosure to August 23, 2026.