ArcadeDB Authentication Bypass in gRPC Transaction Executor

ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run unrestricted JavaScript that creates server-wide administrator accounts.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

ArcadeDB versions before 26.8.1 contain a critical authentication bypass vulnerability in their gRPC transaction executor. When processing beginTransaction requests, the system fails to properly bind authenticated principals to the execution thread, allowing authenticated users with read-only permissions to bypass scripting authorization checks. This vulnerability is particularly severe because it enables attackers to execute arbitrary JavaScript commands through the executeCommand function, potentially creating server-wide administrator accounts and achieving complete system compromise. Organizations running ArcadeDB as a database backend for applications handling sensitive data face immediate risk of privilege escalation and unauthorized administrative access.

Casky's 224 mapped skills detect the attack patterns underlying this vulnerability by analyzing indicators across MITRE ATT&CK's Privilege Escalation (TA0004) techniques. Practitioners using Casky would identify suspicious patterns including: improper thread context handling in transaction processing, authorization checks that don't propagate to child execution threads, and authentication state mismatches between API layers. Claude's extended reasoning capabilities flag the logical inconsistency between a user's assigned permissions and their ability to execute high-privilege JavaScript operations. Security teams would see findings highlighting gRPC transaction flows where authenticated context is lost, anomalous JavaScript execution from low-privilege accounts, and creation of administrative principals outside normal workflows—each pattern mapping to specific MITRE techniques that reveal how the initial authentication bypass cascades into privilege escalation.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-75843.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-75843

Casky has 224 skills that investigate the attack patterns behind CVE-2026-75843. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn