Skip to content
CVE PROGRAM SOURCE RECORD7.7 High

CVE-2026-67357

ArcadeDB before 26.7.3 Information Disclosure via get_server_settings

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that leaks the arcadedb.ha.clusterToken in cleartext. Attackers with MCP access can retrieve the cluster token and use it with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate root and achieve full server compromise.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ArcadeData arcadedb

Default version status: unaffected

  • 0 to < 26.7.3affected
  • 26.7.3unaffected

References