PT-2026-76949 · Arcadedb · Arcadedb
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
ArcadeDB versions prior to 26.8.1
Description
The MongoDB wire-protocol plugin fails to enforce SASL (Simple Authentication and Security Layer) authentication on data commands. This allows unauthenticated attackers to connect to port 27017 without credentials and execute commands such as insert, find, update, delete, and create against any database.
Recommendations
Update to version 26.8.1 or later.
Exploit
Fix
Missing Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Arcadedb