漏洞描述
ArangoDB <= 3.12.10.1 contains an authentication bypass in the default server.authentication-system-only=true mode (GHSA-rrgq-978q-36mq). The auth gate evaluates the raw URL while action dispatch uses URL-decoded suffixes. Encoding the leading underscore as %5f makes protected /_api/simple/* actions appear public to the auth gate but dispatches as privileged system actions, allowing unauthenticated read/write of the _users collection including password hashes.Chained with GHSA-rvhw-4hpw-9vrx (client-controlled isSystem:true in REST task creation), this yields root-context command execution in the official container image where arangod runs as UID 0.
影响产品
暂无结构化产品信息。
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。