CVE-2026-93595Disclosure

LOWCVSS 7.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

ArcadeDB before 26.9.1 contains an access control bypass vulnerability in the query_database tool exposed through the AI chat endpoints. The tool executes queries without binding the authenticated principal to DatabaseContext, causing per-type and per-bucket ACL checks to silently no-op and allowing authenticated users to read data they are explicitly denied at the per-type level. Attackers can prompt the AI assistant to execute queries against restricted types or buckets to retrieve sensitive data that would be rejected through normal query endpoints.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve

Full discourse1 post

NewNormal Security@NewScanTeam46d
Disclosure
NewNormal Security turns CVEs since the previous batch into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 19 Sep 2026 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: 🖥️ Container registry open to anonymous push, or running a build whose bearer-token check can be bypassed — every image, and a tag they can overwrite (zot CVE-2026-61833) 🖥️ Database console on the internet — a login in front of a database whose permission checks any account can walk around (ArcadeDB CVE-2026-93593, CVE-2026-93594, CVE-2026-93595, CVE-2026-93598) 🖥️ Self-hosted AI model server with no authentication — free inference on your GPUs, and one bad request stops the engine for everyone (as seen in vLLM CVE-2026-93592) Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #ExposedInterface #CSO #REDTEAM
Post summary
The text announces four newly disclosed CVEs with technical summaries and recommends using NewScan as a detection tool, but does not mention PoCs, exploits, active exploitation, or patches.
0001066
7 followersView on X

Explore more

Back to dashboard