CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-75843 — ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC tra...

·Source: NIST NVD

Updated:

Executive Summary

ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run unrestricted JavaScript that creates server-wide administrator accounts.

Analysis

ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run unrestricted JavaScript that creates server-wide administrator accounts. CVSS Score: 9.9. Published: 2026-08-18T12:19:34.740.

Indicators of Compromise (1)

CVE (1)
CVE-2026-75843
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 18, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

FDA Weighing Possible Regs for GenAI Medical Devices

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/fda-weighing-possible-regs-for-generative-ai-medical-devices-image_small-6-a-32593.jpg" align=right hspace=4><b>Agency Seeks Public Input on Risk-Based Oversight Approach Across Product Life Cycle</b><br>The U.S. Food and Drug Administration is seeking public feedback on the varying risks and other considerations involving generat

Bank Info Security
MEDIUMVulnerabilityNEW

When AI Risk Becomes a Board Liability

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/when-ai-risk-becomes-board-liability-image_small-9-a-32594.jpg" align=right hspace=4><b>CIOs Can Strengthen Oversight Through Reporting, Records and Insurance Reviews</b><br>AI failures can trigger financial, regulatory and reputational exposure that reaches the boardroom. Reed Smith partners Carolyn Rosenberg and Andy Moss explai

Bank Info Security
CRITICALVulnerability

Critical GitLab Zero-Click Flaw Poses Mitigation Challenges

A lack of technical details could make it hard for organizations running self-managed GitLab versions to detect potential exploitation of CVE-2026-19478.

CVE-2026-19478
Dark Reading