PT-2026-76949

CVE-2026-75852

Published

2026-08-18

Updated

2026-10-22

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.8.1

Description The MongoDB wire-protocol plugin fails to enforce SASL (Simple Authentication and Security Layer) authentication on data commands. This allows unauthenticated attackers to connect to port 27017 without credentials and execute commands such as insert, find, update, delete, and create against any database.

Recommendations Update to version 26.8.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-306: Missing Authentication for Critical Function

Related identifiers

CVE-2026-75852