What is new in ArcadeDB 26.7.3?

ArcadeDB 26.7.3 is a focused hotfix on top of 26.7.2. It closes three security advisories: the MCP command transport bypassing all engine permission checks, the MCP get_server_settings tool leaking the HA clusterToken in cleartext, and JavaScript/Java triggers allowing a schema admin to escalate to server-wide admin. It also repairs a data-loss regression in the 26.7.2 commutative edge-append merge that affected multi-page edge chunks.

Do I need to export and re-import my database to upgrade to 26.7.3?

No. There are no breaking changes and no schema migration in 26.7.3, so no export or import is required. As always, we recommend creating a database backup before upgrading.

ArcadeDB 26.7.3: Three Security Advisories and a Super-Node Edge-Merge Data-Loss Fix

Q: Who should upgrade to ArcadeDB 26.7.3 urgently?

Upgrading from 26.7.2 is recommended for everyone, and especially urgent for deployments that expose the MCP server, run in server or multi-tenant mode, or store high-degree (super-node) graphs. The MCP transport advisory allowed a non-root, MCP-allowed reader to perform arbitrary writes, DDL and schema or security mutation.

ArcadeDB 26.7.3 is a hotfix on top of 26.7.2. It closes three security advisories, two in the MCP server transport and one in the JavaScript/Java trigger authorization gate, and repairs a data-loss regression in the commutative super-node edge-append merge that 26.7.2 introduced.

Upgrade if you can. It matters most if you expose the MCP server, run in server or multi-tenant mode, or store high-degree (super-node) graphs. There are no breaking changes and no schema migration in this release.

Major Highlights

Security Advisories

All three come from the same internal audit that produced the 26.7.2 fixes, covering MCP-transport and trigger surfaces that round did not reach.

MCP command transport disabled all engine permission checks (GHSA-6x73-v3rc-f57c). The MCP transport never bound the authenticated principal onto the request thread’s DatabaseContext, so the engine permission gates (which are deliberate no-ops when no user is bound) silently passed for every MCP caller. A non-root, MCP-allowed reader could perform arbitrary writes, DDL, and schema or security mutation; the query + js sub-case could execute arbitrary in-JVM JavaScript. The principal is now bound at the single DB-resolution chokepoint and cleared on the pooled worker thread, so the engine per-user gates enforce for MCP exactly as they do for the HTTP, Bolt, PostgreSQL, and gRPC transports.
MCP get_server_settings leaked the HA clusterToken in cleartext (GHSA-p9wc-4fhr-78wm). The MCP get_server_settings tool masked only settings whose key contained "password", so arcadedb.ha.clusterToken was returned raw. That token is the trust anchor for cluster-forwarded authentication, so leaking it enables full root impersonation. This is the MCP sibling of the 26.7.2 fix (GHSA-46hj-24h4-j8gf); the tool now redacts both value and default via GlobalConfiguration.isHidden(), matching GetServerHandler.
JavaScript / Java triggers could escalate a schema admin to server-wide admin (GHSA-38pf-6hp2-pxww). A JAVASCRIPT trigger binds the real database object into a GraalVM context, so its script could call database.getSecurity().createUser(...) and escalate an UPDATE_SCHEMA (schema-admin) user to a server-wide admin; a JAVA trigger runs an arbitrary loaded class. Creating either host-code trigger type now requires UPDATE_SECURITY at the LocalSchema.createTrigger chokepoint, mirroring the DEFINE FUNCTION ... LANGUAGE js gate (GHSA-vwjc-v7x7-cm6g). Declarative SQL triggers keep UPDATE_SCHEMA, and schema reload of existing triggers is unaffected.

Major Fixes

Graph Engine

Edge-append merge no longer reverts concurrent writes on multi-page edge chunks (#5302). The commutative edge-append merge (GRAPH_EDGE_APPEND_MERGE, introduced in 26.7.2) resolved a commit-time page conflict by re-deriving the conflicted page and replaying the transaction’s tracked appends. For an edge chunk stored as a multi-page record (a chunk that straddles a page boundary) this re-derivation was unsound: the rebase re-read the chunk through the transaction’s stale in-transaction page copy and committed it, silently reverting concurrently committed appends on the continuation page. The observable symptoms were zeroed chunk tails, shifted or aliased pairs, lost edges, and BufferUnderflowException on later traversals of the vertex.

Only records living entirely in place on the conflicted page are now re-derived. Multi-page and indirected (placeholder) chunk records fall back to the standard full-transaction retry. Single-page chunks, which are the vast majority and include all super-node stripe chunks, keep the merge.

MCP Server

get_schema now builds its schema through a dedicated buildSchema path.
The MCP dispatcher handles a missing resource with a proper MCPResourceNotFoundException instead of a generic failure.

Getting Started with 26.7.3

Docker

docker pull arcadedata/arcadedb:26.7.3

Visit our Docker Hub repository for more information.

Maven

<dependency>
    <groupId>com.arcadedb</groupId>
    <artifactId>arcadedb-engine</artifactId>
    <version>26.7.3</version>
</dependency>

All artifacts are available on Maven Central.

Documentation

For details on features and usage, see the documentation.

Compatibility Note

This release contains no breaking changes and no schema migration. It maintains 100% compatibility with previous database formats, meaning no export/import is required when upgrading. As always, we recommend creating a database backup before upgrading.

Download ArcadeDB 26.7.3 now: GitHub Releases

Thanks to everyone in the community who reported issues, opened PRs, and helped shape this release.

Luca Garulli ArcadeDB Founder