Skip to content
CVE PROGRAM SOURCE RECORD7.7 High

CVE-2026-68578

ArcadeDB before 26.7.3 Authentication Bypass via MCP Transport

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via the query tool.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ArcadeData arcadedb

Default version status: unaffected

  • 0 to < 26.7.3affected
  • 26.7.3unaffected

References