Severe ArangoDB Vulnerabilities Enable Critical Exploits

ArangoDB, a popular database management system, is currently under scrutiny due to two significant vulnerabilities that could lead to unauthorized access and root-level code execution on compromised systems. These flaws, impacting versions up to 3.12.10.1, pose a serious threat to internet-facing databases and containerized environments.

Exploiting Authentication Bypass

The first vulnerability, designated as GHSA-rrgq-978q-36mq, carries a CVSS 3.1 score of 9.8, highlighting its severity. The flaw allows attackers to bypass authentication by exploiting discrepancies in URL parsing. While ArangoDB’s default configuration requires authentication for paths starting with /_, the routing mechanism misinterprets URL-encoded versions of these paths as public, enabling unauthorized access.

This flaw allows attackers to access protected API endpoints without valid credentials, potentially retrieving sensitive data such as the root account password hash. The vulnerability was uncovered by Remedio analysts during a review of ArangoDB’s HTTP attack surface, emphasizing the risk of inconsistent request handling in critical systems.

Root-Level Code Execution Threat

The second vulnerability, identified as GHSA-rvhw-4hpw-9vrx and assigned a CVSS score of 9.9, involves ArangoDB’s handling of scheduled JavaScript tasks. By manipulating the isSystem parameter, attackers can execute tasks within the server’s highly privileged context, a domain typically reserved for internal operations.

This flaw arises from inadequate checks on the HTTP handler, allowing client-supplied values to determine execution privileges. Once a task is elevated to this context, it can perform actions like reading sensitive files, making outbound requests, and potentially leading to remote code execution. On official container images, where the ArangoDB process runs as root, this vulnerability becomes particularly dangerous.

Patch and Prevention Measures

ArangoDB was informed of these vulnerabilities on August 23, 2026, and quickly released patches in version 3.12.11 on August 31. Organizations using affected versions should upgrade immediately, limit database exposure to trusted networks, and rotate any potentially compromised credentials.

These incidents underscore the importance of consistent request handling and the dangers of allowing client inputs to affect system-level privileges. Developers are urged to standardize and verify requests uniformly across all handlers to prevent similar vulnerabilities.

The rapid response to patch these critical vulnerabilities highlights the need for prompt updates and access restrictions to safeguard against potential exploits. Keeping systems updated and monitoring for unusual activities are essential strategies in maintaining robust cybersecurity defenses.