Two essential ArangoDB vulnerabilities can permit unauthenticated attackers to entry protected database APIs and, after acquiring legitimate database entry, escalate to root-level code execution on affected hosts.
Safety researchers reported the vulnerabilities to ArangoDB on August 23, 2026. Patches shipped on August 31, adopted by GitHub Safety Advisories printed on September 6: GHSA-rrgq-978q-36mq for the authentication bypass and GHSA-rvhw-4hpw-9vrx for the privileged task-execution situation.
Each have been rated Crucial, with CVSS 3.1 scores of 9.8 and 9.9 respectively. CVE identifiers had been pending task at disclosure time.
The primary situation stems from a parser discrepancy between ArangoDB’s authentication gate and its HTTP request router.
ArangoDB treats paths starting with /_api and /_admin as protected endpoints, whereas paths not starting with /_ may be thought of unauthenticated software routes when system-only authentication is enabled by default.
Nonetheless, the authorization part evaluates the uncooked path acquired from the community, whereas the router later evaluates URL-decoded path parts.
An encoded underscore, %5f, shouldn’t be interpreted as an underscore throughout the preliminary prefix verify however turns into one when the router resolves the vacation spot.
Because of this, a request focusing on /%5fapi/... could go the unauthenticated-path validation as a result of its uncooked type doesn’t start with /_.
The routing layer then decodes %5fapi into _api and dispatches the request to a usually protected ArangoDB REST API handler.
The excellence is operationally extreme. A traditional request to /_api/... with out credentials returns 401 Unauthorized.
Changing solely the primary underscore with %5f can attain the underlying privileged endpoint with no session, password, or token.
With a legitimate technique and request construction, an attacker may learn, modify, or delete information in ArangoDB databases.
Researchers demonstrated entry to delicate system collections, together with the doc containing the basis account’s password hash.
Remedio Researchers mentioned that, the vulnerabilities, fastened in ArangoDB 3.12.11, display how inconsistent URL parsing and a client-controlled privilege flag can collapse authentication and execution boundaries.
ArangoDB Vulnerabilities
The vulnerability is tracked as GHSA-rrgq-978q-36mq and carries a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting community exploitation with out authentication or person interplay.
HTTP Technique PUT with a HTTP request physique → then HTTP response is 200 OK, and the key doc comes straight again – nonetheless no person logged in.
The second vulnerability impacts ArangoDB’s HTTP interface for scheduled background duties. Duties execute JavaScript and help separate sandboxed and inside execution contexts.
The inner context is meant for server-controlled operations and might entry capabilities unavailable to abnormal person duties.
The susceptible HTTP handler accepted an isSystem Boolean straight from the shopper request physique and used it to pick the duty context.
A 405 Unsupported technique response is a crucial indicator: it reveals the authentication barrier was bypassed and the request reached the protected handler, even when the chosen HTTP verb is invalid.
Setting isSystem: true may trigger submitted JavaScript to execute in ArangoDB’s inside context, regardless of the caller not being an inside part.
A separate inside JavaScript API contained an specific verify that rejected non-internal makes an attempt to create system duties.
The HTTP route lacked that equal authorization verify, leaving the JSON discipline itself because the privilege boundary.
As soon as an attacker has authenticated database write entry doubtlessly by exploiting the primary bug to retrieve and crack weak credentials the vulnerability can present broad host-level capabilities.
Inner-context duties can learn and write recordsdata outdoors the conventional sandbox and make outbound HTTP requests. That creates paths to secret theft, persistence, lateral motion by SSRF, and host compromise.
The affect is particularly severe in deployments the place arangod runs as root, together with the official container picture described within the disclosure.
Underneath these circumstances, arbitrary file write can develop into sensible root-level distant code execution even when direct process-spawning performance is disabled.
An attacker may doubtlessly write to SSH authorized-key places, scheduled-task configurations, startup scripts, or different recordsdata consumed by privileged providers.
Inner file reads may additionally expose /and so forth/shadow, TLS non-public keys, cluster secrets and techniques, and setting variables resembling ARANGO_ROOT_PASSWORD when current in container course of environments.
The second situation, GHSA-rvhw-4hpw-9vrx, is rated CVSS 9.9 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
It requires privileges, however the scope adjustments as a result of code executing by the database course of can have an effect on the underlying host.
Organizations ought to improve to ArangoDB 3.12.11 or a later supported safety launch instantly.
ArangoDB’s 3.12 department stays supported, and three.12.11 is listed as the present launch in public release-tracking sources.
Defenders must also assessment reverse-proxy, WAF, and software logs for requests containing URL-encoded underscore sequences resembling %5fapi or %5Fapi, notably when adopted by API paths.
Investigators ought to hunt for sudden scheduled duties, activity definitions containing isSystem: true, modifications to database system collections, and anomalous outbound site visitors from ArangoDB servers.
The 2 bugs are a reminder that safe parts don’t assure a safe system. Authorization have to be enforced after canonicalization, and privileged execution modes have to be determined by trusted server-side state not a client-supplied JSON discipline.
★ Study 7 Metric-Gated AI SOC Deployment Phases – Obtain Free AI SOC Deployment Playbook 2026.
