CVE-2026-68578

HIGH 7.5

ArcadeDB before 26.7.3 Authentication Bypass via MCP Transport

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via the query tool.

CWE	CWE-306
Vendor	arcadedata
Product	arcadedb
Published	Aug 2, 2026
Last Updated	Aug 2, 2026

Stay Ahead of the Next One

Get instant alerts for arcadedata arcadedb

Be the first to know when new high vulnerabilities affecting arcadedata arcadedb are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

ArcadeData / arcadedb

0 < 26.7.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-6x73-v3rc-f57c vulncheck.com: https://www.vulncheck.com/advisories/arcadedb-authentication-bypass-via-mcp-transport

Credits

🔍 manus-use