ETK-2026-3556Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-3556",
  "cve_id": null,
  "display_id": "ETK-2026-3556",
  "ghsa_id": "GHSA-jxwp-5ghh-f385",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "ArcadeDB server security-file reload flaws",
  "summary": "ArcadeDB server releases before 26.11.1 can mishandle reloads of user, group, and API-token security files. An attacker able to influence relevant security files or benefit from a failed reload may retain a revoked token, trigger replacement of custom access settings, or expose generated root credentials in service logs; some conditions can also prevent clean shutdown. Exploitation depends on a security-file reload and affected filesystem, startup-timing, or console conditions.",
  "mitigation": "Upgrade com.arcadedb:arcadedb-server to version 26.11.1. Until the upgrade is complete, tightly restrict access to security files and logs, and review reload failures and token revocations rather than relying on automatic reload behavior.",
  "vendor": "maven",
  "product": "maven:com.arcadedb:arcadedb-server",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 26.10.2"
      ],
      "ecosystem": "maven",
      "fixed_versions": [
        "26.11.1"
      ],
      "package_name": "com.arcadedb:arcadedb-server",
      "purl": "pkg:maven/com.arcadedb/arcadedb-server"
    }
  ],
  "cwes": null,
  "cvss_score": 7,
  "cvss_src": "ethiack_provisional",
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 8.10756485,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-11-04T21:25:19+00:00",
      "days": -0.13437026497685184,
      "is_lower_bound": true,
      "measured_at": "2026-11-05T00:38:48.740349+00:00",
      "url": "https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-jxwp-5ghh-f385"
    }
  }
}