{"id":18553,"date":"2026-09-09T12:31:14","date_gmt":"2026-09-09T12:31:14","guid":{"rendered":"https:\/\/techtrendfeed.com\/?p=18553"},"modified":"2026-09-09T12:31:15","modified_gmt":"2026-09-09T12:31:15","slug":"crucial-arangodb-bugs-expose-complete-databases-and-allow-distant-code-execution-as-root","status":"publish","type":"post","link":"https:\/\/techtrendfeed.com\/?p=18553","title":{"rendered":"Crucial ArangoDB Bugs Expose Complete Databases and Allow Distant Code Execution as Root"},"content":{"rendered":"


\n<\/p>\n

\n

Two essential ArangoDB vulnerabilities can permit unauthenticated attackers to entry protected database APIs and, after acquiring legitimate database entry, escalate to root-level code execution on affected hosts. <\/p>\n

Safety researchers reported the vulnerabilities to ArangoDB on August 23, 2026. Patches shipped on August 31, adopted by GitHub Safety Advisories printed on September 6: GHSA-rrgq-978q-36mq for the authentication bypass and GHSA-rvhw-4hpw-9vrx for the privileged task-execution situation. <\/p>\n

Each have been rated Crucial, with CVSS 3.1 scores of 9.8 and 9.9 respectively. CVE identifiers had been pending task at disclosure time.<\/p>\n

The primary situation stems from a parser discrepancy between ArangoDB\u2019s authentication gate and its HTTP request router. <\/p>\n

ArangoDB treats paths starting with \/_api<\/code> and \/_admin<\/code> as protected endpoints, whereas paths not starting with \/_<\/code> may be thought of unauthenticated software routes when system-only authentication is enabled by default.<\/p>\n

Nonetheless, the authorization part evaluates the uncooked path acquired from the community, whereas the router later evaluates URL-decoded path parts. <\/p>\n

An encoded underscore, %5f<\/code>, shouldn’t be interpreted as an underscore throughout the preliminary prefix verify however turns into one when the router resolves the vacation spot.<\/p>\n

Because of this, a request focusing on \/%5fapi\/...<\/code> could go the unauthenticated-path validation as a result of its uncooked type doesn’t start with \/_<\/code>. <\/p>\n

\n
\"401
401 Unauthorized (Supply : Remedio).<\/figcaption><\/figure>\n<\/div>\n

The routing layer then decodes %5fapi<\/code> into _api<\/code> and dispatches the request to a usually protected ArangoDB REST API handler.<\/p>\n

The excellence is operationally extreme. A traditional request to \/_api\/...<\/code> with out credentials returns 401 Unauthorized<\/code>. <\/p>\n

Changing solely the primary underscore with %5f<\/code> can attain the underlying privileged endpoint with no session, password, or token. <\/p>\n

With a legitimate technique and request construction, an attacker may learn, modify, or delete information in ArangoDB databases. <\/p>\n

Researchers demonstrated entry to delicate system collections, together with the doc containing the basis account\u2019s password hash. <\/p>\n

Remedio Researchers mentioned that<\/a>, the vulnerabilities, fastened in ArangoDB 3.12.11, display how inconsistent URL parsing and a client-controlled privilege flag can collapse authentication and execution boundaries.<\/p>\n

ArangoDB Vulnerabilities<\/strong><\/h2>\n

The vulnerability is tracked as GHSA-rrgq-978q-36mq and carries a CVSS vector of CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H<\/code>, reflecting community exploitation with out authentication or person interplay.<\/p>\n

HTTP Technique\u00a0PUT<\/code>\u00a0with a HTTP request physique \u2192 then HTTP response is\u00a0200 OK<\/code>, and the key doc comes straight again \u2013 nonetheless no person logged in.<\/p>\n

\n
\"HTTP
HTTP 200 OK (Supply : Remedio).<\/figcaption><\/figure>\n<\/div>\n

The second vulnerability impacts ArangoDB\u2019s HTTP interface for scheduled background duties. Duties execute JavaScript and help separate sandboxed and inside execution contexts. <\/p>\n

The inner context is meant for server-controlled operations and might entry capabilities unavailable to abnormal person duties.<\/p>\n

The susceptible HTTP handler accepted an isSystem<\/code> Boolean straight from the shopper request physique and used it to pick the duty context. <\/p>\n

A 405 Unsupported technique<\/code> response is a crucial indicator: it reveals the authentication barrier was bypassed and the request reached the protected handler, even when the chosen HTTP verb is invalid.<\/p>\n

Setting isSystem: true<\/code> may trigger submitted JavaScript to execute <\/a>in ArangoDB\u2019s inside context, regardless of the caller not being an inside part.<\/p>\n

\n
\" 405
405 Unsupported technique (Supply : Remedio).<\/figcaption><\/figure>\n<\/div>\n

A separate inside JavaScript API contained an specific verify that rejected non-internal makes an attempt to create system duties. <\/p>\n

The HTTP route lacked that equal authorization verify, leaving the JSON discipline itself because the privilege boundary.<\/p>\n

As soon as an attacker has authenticated database write entry doubtlessly by exploiting the primary bug to retrieve and crack weak credentials the vulnerability can present broad host-level capabilities. <\/p>\n

Inner-context duties can learn and write recordsdata outdoors the conventional sandbox and make outbound HTTP requests. That creates paths to secret theft, persistence, lateral motion by SSRF<\/a>, and host compromise.<\/p>\n

The affect is particularly severe in deployments the place arangod<\/code> runs as root, together with the official container picture described within the disclosure. <\/p>\n

Underneath these circumstances, arbitrary file write can develop into sensible root-level distant code execution even when direct process-spawning performance is disabled.<\/p>\n

An attacker may doubtlessly write to SSH authorized-key places, scheduled-task configurations, startup scripts, or different recordsdata consumed by privileged providers. <\/p>\n

Inner file reads may additionally expose \/and so forth\/shadow<\/code>, TLS non-public keys, cluster secrets and techniques, and setting variables resembling ARANGO_ROOT_PASSWORD<\/code> when current in container course of environments.<\/p>\n

The second situation, GHSA-rvhw-4hpw-9vrx, is rated CVSS 9.9 with the vector CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:C\/C:H\/I:H\/A:H<\/code>. <\/p>\n

It requires privileges, however the scope adjustments as a result of code executing by the database course of can have an effect on the underlying host.<\/p>\n

Organizations ought to improve to ArangoDB 3.12.11 or a later supported safety launch instantly. <\/p>\n

ArangoDB\u2019s 3.12 department stays supported, and three.12.11 is listed as the present launch in public release-tracking sources.<\/p>\n

Defenders must also assessment reverse-proxy, WAF, and software logs for requests containing URL-encoded underscore sequences resembling %5fapi<\/code> or %5Fapi<\/code>, notably when adopted by API paths. <\/p>\n

Investigators ought to hunt for sudden scheduled duties, activity definitions containing isSystem: true<\/code>, modifications to database system collections, and anomalous outbound site visitors from ArangoDB servers.<\/p>\n

The 2 bugs are a reminder that safe parts don’t assure a safe system. Authorization have to be enforced after canonicalization, and privileged execution modes have to be determined by trusted server-side state not a client-supplied JSON discipline.<\/p>\n

\u2605 Study 7 Metric-Gated AI SOC Deployment Phases \u2013 Obtain Free AI SOC Deployment Playbook 2026<\/a><\/strong><\/strong>.<\/strong><\/strong><\/p>\n<\/div>\n\n","protected":false},"excerpt":{"rendered":"

Two essential ArangoDB vulnerabilities can permit unauthenticated attackers to entry protected database APIs and, after acquiring legitimate database entry, escalate to root-level code execution on affected hosts. Safety researchers reported the vulnerabilities to ArangoDB on August 23, 2026. Patches shipped on August 31, adopted by GitHub Safety Advisories printed on September 6: GHSA-rrgq-978q-36mq for the […]<\/p>\n","protected":false},"author":2,"featured_media":18555,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[58],"tags":[10490,3207,977,420,2627,3488,7135,2205,4300,1151,6571],"class_list":["post-18553","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-arangodb","tag-bugs","tag-code","tag-critical","tag-databases","tag-enable","tag-entire","tag-execution","tag-expose","tag-remote","tag-root"],"_links":{"self":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/18553","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=18553"}],"version-history":[{"count":1,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/18553\/revisions"}],"predecessor-version":[{"id":18554,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/18553\/revisions\/18554"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/media\/18555"}],"wp:attachment":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=18553"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=18553"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=18553"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}