Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-67343

ArcadeDB before 26.7.2 Cluster Token Disclosure via GET /api/v1/server

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing authenticated users to retrieve the arcadedb.ha.clusterToken value in cleartext. Attackers can use the leaked token with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate root and execute administrative actions including user creation, database operations, and server shutdown.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ArcadeData arcadedb

Default version status: unaffected

  • 0 to < 26.7.2affected
  • 26.7.2unaffected
pkg:maven/com.arcadedb/arcadedb-server

References