CVE-2026-67342

criticalCVSS 9.8covered by 1 sourcefirst seen 2026-08-01

ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling affected endpoints with arbitrary database parameters.

⚡ Watch CVE-2026-67342

Get an email if CVE-2026-67342 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

criticalCVE-2026-67342: ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers…nvd · 2026-08-01

External references

NVD record for CVE-2026-67342

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-67342 status](https://www.csirts.com/badge/CVE-2026-67342)](https://www.csirts.com/cve/CVE-2026-67342)