Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2026-75852

ArcadeDB MongoDB wire protocol authentication bypass cross-database

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ArcadeData arcadedb

Default version status: unaffected

  • 0 to < 26.8.1affected
  • 26.8.1unaffected
pkg:maven/com.arcadedb/arcadedb-mongodbw

References