ArcadeDB HTTP Handler Authorization Bypass

Technical Analysis

The vulnerability stems from insufficient server-side validation of database access permissions within ArcadeDB's HTTP API layer, specifically in handlers tied to time series data, batch operations, and monitoring integrations (Prometheus/Grafana). By directly calling these endpoints and supplying arbitrary database names as parameters, an attacker can traverse authorization boundaries to read, write, or delete data in databases they should not have access to, without needing valid credentials scoped to those databases. This is functionally an IDOR/broken object-level authorization (BOLA) flaw exposed over HTTP, making it exploitable via simple crafted requests and scriptable at scale. ArcadeDB is increasingly used as a multi-model backend for RAG pipelines and vector/graph storage supporting AI agent memory and retrieval systems, so organizations running agent frameworks with ArcadeDB as a knowledge store are at risk of unauthorized data exfiltration, poisoning of embeddings/context data, or corruption of agent memory stores via this flaw.

Affected Systems

ArcadeDB server versions prior to 26.7.2; specifically HTTP handlers for time series, batch, Prometheus metrics, and Grafana integration endpoints exposed via the ArcadeDB HTTP API.

Indicators of Compromise

• N/A - no specific hashes, IPs, or domains published; indicators would include unauthorized HTTP requests to /api/v1/timeseries, /api/v1/batch, /prometheus, or /grafana endpoints referencing unexpected database names in request parameters

Remediation Steps

1. 1

   Upgrade ArcadeDB

   Update all ArcadeDB deployments to version 26.7.2 or later, where the authorization checks for affected HTTP handlers have been fixed.

2. 2

   Restrict Network Exposure

   Limit access to ArcadeDB HTTP endpoints to trusted internal networks or VPNs; do not expose the HTTP API directly to the internet.

3. 3

   Audit Access Logs

   Review HTTP access logs for anomalous requests to time series, batch, Prometheus, and Grafana endpoints referencing unexpected or unauthorized database names.

4. 4

   Enforce Least Privilege

   Reconfigure database user roles and credentials to minimize the blast radius if authorization checks are bypassed, and rotate any credentials or API keys stored in or accessible via ArcadeDB.

5. 5

   Monitor Agent/RAG Integrations

   For organizations using ArcadeDB as a backend for AI agent memory, RAG retrieval, or vector storage, audit data integrity and access patterns to detect potential poisoning or exfiltration of embedded knowledge bases.