CVE-2026-67343

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.7.2

Description Authenticated users can retrieve the arcadedb.ha.clusterToken value in cleartext because the software fails to properly redact the cluster token in the 'GET /api/v1/server' endpoint. An attacker can use this leaked token via the X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate the root user and perform administrative actions, such as creating users, executing database operations, and shutting down the server.

Recommendations Update to version 26.7.2 or later.