Incomplete Deny-list Vulnerability in ArcadeDB Product by ArcadeData

CVE-2026-93598

What is CVE-2026-93598?

ArcadeDB, specifically versions up to 26.8.1, is prone to a vulnerability that stems from an incomplete deny-list in its polyglot script sandbox. The issue arises when the class java.util.ResourceBundle is listed as denied, but its subclasses are not covered. This gap allows users with the UPDATE_SCHEMA privilege to reference subclasses like java.util.PropertyResourceBundle and invoke static methods to access sensitive resources within the application's classpath. This could potentially expose important configuration details such as database credentials and API keys while it does not enable arbitrary filesystem read or remote code execution. The issue has been remediated in version 26.9.1.

References