Repository navigation
Security: ArcadeData/arcadedb
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
GET /api/v1/cluster names every single-bucket type of every database the caller may open, with no per-type readability filter, and the new census sanctions the walk as internalGHSA-48q6-q453-cm77 published
Nov 4, 2026 by lvcaLow -
Analysing a Gremlin script on the auto engine writes through the Graph API and then reports the script as a read, so the MCP read-only query tool commits the write it was about to refuseGHSA-r946-225c-5x88 published
Nov 4, 2026 by lvcaModerate -
An unauthenticated Redis connection can be held open indefinitely at about 0.3 bytes per second, defeating the idle socket timeout and pinning one executor thread per connectionGHSA-9cx8-qjp8-hcmr published
Nov 4, 2026 by lvcaModerate -
ArcadeDbGrpcAdminService.getDatabaseInfo reads schema and per-type record counts without binding the authenticated principal, the shape the sibling handler's own comment forbidsGHSA-4mmv-84cq-wpc5 published
Nov 4, 2026 by lvcaLow -
Three schema listings ignore the per-type ACL and hand a denied user the full definition of a type it cannot read, including a materialized view's defining SQLGHSA-vpxw-wqc5-hvvj published
Nov 4, 2026 by lvcaModerate -
The unauthenticated Redis log amplification already public as issue 10597 also destroys the server log history, because the shipped handler is a bounded rotating oneGHSA-hphw-285h-wx93 published
Nov 4, 2026 by lvcaLow -
Two authentication-state hardening items: MCP tool refusals let an authenticated caller probe which databases exist, and a failed Bolt LOGON leaves the previous principal boundGHSA-34v6-3chg-hcjq published
Nov 4, 2026 by lvcaLow -
MCP: the two upsert tools create types with allowSchemaChange set to false, the same schema change execute_command refuses on the same serverGHSA-6jr9-6vw5-xjf6 published
Nov 4, 2026 by lvcaModerate -
Full-text BM25 statistics ignore bucket access control: hidden subtype documents are countable through EXPLAIN/PROFILE, and restricted users fail their first searchGHSA-875c-3v5j-4wh2 published
Nov 4, 2026 by lvcaLow
