ArcadeDB JavaScript Trigger Privilege Escalation

ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins to call getSecurity().createUser() without permission checks. Attackers with UPDATE_SCHEMA permission can create triggers that execute JavaScript to create server-wide admin users, escalating privileges beyond their authorization level.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

ArcadeDB versions before 26.7.3 contain a critical privilege escalation vulnerability where the database incorrectly exposes its LocalDatabase object to JavaScript trigger contexts with unrestricted access (HostAccess.ALL). This allows users with UPDATE_SCHEMA permissions to create malicious database triggers that bypass security checks and call sensitive administrative functions like getSecurity().createUser(). Attackers can exploit this to create server-wide admin accounts without proper authorization, completely circumventing the platform's access control mechanisms. Any organization running vulnerable ArcadeDB instances with untrusted or compromised schema administrators faces immediate risk of full system compromise.

Casky's 224 mapped security skills help practitioners detect this attack pattern by correlating indicators across TA0004 (Privilege Escalation) and related MITRE ATT&CK techniques using Claude's extended reasoning. Practitioners would identify suspicious patterns such as: unexpected trigger creation events by schema-admin accounts, new admin user accounts appearing without corresponding permission requests, database function calls from JavaScript contexts that should be isolated, and schema modification activities followed by lateral privilege escalation. The platform's skill-based detection framework enables analysts to recognize the attack chain—from initial schema modification permissions through trigger deployment to unauthorized admin account creation—rather than relying on single-point indicators. This correlative approach surfaces the subtle authorization bypass that makes this vulnerability particularly dangerous compared to direct exploitation scenarios.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-67356.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-67356

Casky has 224 skills that investigate the attack patterns behind CVE-2026-67356. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn