PT-2026-67331 · Arcadedb · Arcadedb
CVSS v4.0
7.7
High
| Vector | AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
ArcadeDB versions prior to 26.7.3
Description
An authentication bypass exists in the MCP HTTP transport where the system fails to bind the authenticated principal. This causes engine permission checks to be ignored, allowing non-root users with MCP access to perform arbitrary database writes, Data Definition Language (DDL) operations, and schema mutations. Additionally, these users can execute arbitrary JavaScript code through the query tool.
Recommendations
Update ArcadeDB to version 26.7.3 or later.
Exploit
Fix
Missing Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Arcadedb