Critical ArangoDB Flaws Allow Authentication Bypass and Remote Code Execution as Root

Cybersecuritynews •Tushar Subhra Dutta • September 9, 2026

Two critical flaws in ArangoDB can let an outsider bypass login controls, read or alter database data, and then gain root-level code execution on the underlying host. The issues affect installations through version 3.12.10.1, creating serious risk for internet-facing databases and container deployments. The attack does not rely on stolen passwords, a user click, or […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical ArangoDB Vulnerabilities Enable Remote Code Execution and Data Access Two critical vulnerabilities in ArangoDB were reported on August 23, 2026, allowing unauthenticated attackers to bypass authentication and gain access to protected database APIs. Once access is obtained, attackers can escalate privileges to execute code as root on affected hosts. The vulnerabilities impact all installations up to version 3.12.10.1, posing a significant risk for internet-facing databases and container deployments. Patches were released on August 31, 2026, and GitHub Security Advisories were published on September 6, 2026. The flaws do not require stolen passwords or user interaction for exploitation. Security researchers have emphasized the urgency of applying the patches to mitigate risks. Organizations using affected versions are advised to update immediately to prevent potential breaches. 2 sources 61

Extracted Entities

Critical ArangoDB Flaws Allow Authentication Bypass and Remote Code Execution as Root

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

IP Addresses (1)

MITRE ATT&CK (2)

Platforms (1)