Critical ArangoDB Flaws Enable Authentication Bypass and Root Code Execution
Two critical vulnerabilities in ArangoDB versions prior to 3.12.11 allow attackers to bypass authentication and achieve remote code execution as root.
Two critical flaws discovered in ArangoDB, a popular open-source multi-model NoSQL database, pose a significant risk to internet-facing installations and container deployments. Affecting versions up to 3.12.10.1, these vulnerabilities allow attackers to bypass authentication mechanisms and execute arbitrary code with root privileges on the underlying host system, without needing stolen credentials or user interaction.
The first vulnerability, tracked as GHSA-rrgq-978q-36mq with a CVSS 3.1 score of 9.8, exploits a parsing discrepancy between the ArangoDB server's authentication check and its routing code. In ArangoDB's default system-only authentication mode, paths starting with '/_' are protected and require authentication, while other paths are considered public. Researchers found that by URL-encoding the underscore character (e.g., using '%5f' instead of '_'), an attacker could trick the initial authentication check into treating a protected API endpoint as public. This allows unauthenticated access to sensitive API functions, enabling administrative actions on collections and databases, and even the retrieval of the root account password hash.
The second critical flaw, GHSA-rvhw-4hpw-9vrx, carries a CVSS 3.1 score of 9.9 and impacts ArangoDB's HTTP interface for scheduling JavaScript background tasks. This vulnerability allows an authenticated user with database write permissions to execute arbitrary JavaScript code within the server's highly privileged internal context. Normally, this context is reserved for the server itself and includes robust checks to prevent unauthorized access. However, the HTTP handler for task scheduling failed to enforce these same protections, allowing a client-controlled Boolean value to grant system-level privileges.
Once code execution is achieved within this privileged context, attackers can perform a wide range of malicious actions. This includes reading or writing files directly on the host system, potentially exposing sensitive data such as '/etc/shadow', TLS private keys, or cluster signing material. On containerized deployments where the arangod process runs as root, this can lead to the compromise of critical system secrets. Furthermore, the ability to write files opens a practical path to achieving full remote code execution as root, for instance, by adding an SSH authorized key or modifying service files.
Attackers can chain these two vulnerabilities for a more potent attack. First, they could use the authentication bypass to retrieve the root password hash. Then, leveraging authenticated database write access, they could exploit the second flaw to escape into the privileged task execution environment. This combined exploit allows for a complete takeover of the database host, making it a high-priority target for threat actors seeking access to sensitive data or critical infrastructure.
ArangoDB was notified of these issues on August 23, 2026, and promptly released fixes in version 3.12.11 on August 31, 2026. Advisories detailing the vulnerabilities were published on September 6, with CVE identifiers pending at the time of reporting. Organizations running affected versions of ArangoDB are strongly urged to upgrade to the patched version immediately.
In addition to upgrading, security teams should restrict the network exposure of their ArangoDB instances to trusted networks only. It is also recommended to rotate any potentially compromised credentials and thoroughly investigate logs for any signs of unexpected task creation or suspicious API activity. The broader security lesson emphasizes the critical need for robust input validation and consistent authorization checks across all request handlers to prevent similar parsing-related vulnerabilities.
This incident highlights the ongoing risks associated with vulnerabilities in widely used database systems. The ability to bypass authentication and achieve root-level code execution represents a worst-case scenario for many organizations, underscoring the importance of timely patching and proactive security measures.