PT-2026-67330

CVE-2026-67357

Published

2026-08-02

Updated

2026-10-08

Description by

CVSS 4.0

7.7

High

MetricsAV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.7.3

Description An information disclosure issue exists in the MCP get server settings tool. This flaw allows attackers with MCP access to retrieve the arcadedb.ha.clusterToken in cleartext. By using this token along with the X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers, an attacker can impersonate the root user and achieve full server compromise.

Recommendations Update to version 26.7.3 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Manus-Use

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Related identifiers