ArcadeDB: Thirteen Critical and High Severity Auth/Authz Flaws Disclosed Together
Key findings • Thirteen ArcadeDB vulnerabilities disclosed on August 18, 2026, with critical severity flaws in Redis and MongoDB plugins. • Multiple CVEs involve missing authentication or aut…
Key findings
- Thirteen ArcadeDB vulnerabilities disclosed on August 18, 2026, with critical severity flaws in Redis and MongoDB plugins.
- Multiple CVEs involve missing authentication or authorization checks across various ArcadeDB protocols and handlers.
- Arbitrary file read and server-side request forgery vulnerabilities are among the high-severity issues.
- All disclosed vulnerabilities are patched in ArcadeDB version 26.8.1.
- Affected versions are prior to 26.8.1, with a significant number of issues in versions <= 26.7.3.
On August 18, 2026, a batch of thirteen vulnerabilities was disclosed for ArcadeDB, impacting versions prior to 26.8.1. These vulnerabilities, ranging in severity from medium to critical, primarily stem from issues with authentication and authorization across various plugins and handlers within the database system. The most severe flaws, rated Critical with CVSSv3 scores of 9.8 and 9.9, include missing authentication in the Redis wire-protocol plugin (CVE-2026-75854), unauthenticated command execution in the MongoDB wire-protocol plugin (CVE-2026-75852), and an issue where authenticated principals are not propagated to asynchronous worker threads (CVE-2026-75851), potentially allowing unauthorized script execution.
Several high-severity vulnerabilities also emerged, including a Gremlin wire-protocol plugin flaw (CVE-2026-75853) that enforces authentication but lacks authorization, allowing any authenticated user access to any database. A missing authorization vulnerability in the DELETE FUNCTION SQL statement (CVE-2026-75846) permits any user with database access to delete server-side functions. Additionally, a server-side request forgery (SSRF) vulnerability in the IMPORT DATABASE command (CVE-2026-75844) could be exploited by authenticated attackers to bypass security validators using DNS rebinding. Arbitrary file read vulnerabilities were also disclosed, affecting the OpenCypher LOAD CSV FROM clause (CVE-2026-75842) and the GraalVM JavaScript sandbox (CVE-2026-75840), allowing authenticated users to read local files or access sensitive JAR files.
Medium-severity issues include a bypass of authorization checks in the set_server_setting MCP tool (CVE-2026-75845), where only the global allowAdmin flag is checked, not the caller's role. A similar principal binding issue in batch and time-series HTTP handlers (CVE-2026-75850) bypasses fine-grained per-type ACL checks for deployments using these handlers. Denial of service is possible via the Cypher range() function (CVE-2026-75841), allowing authenticated users to exhaust server heap memory. Finally, an insecure direct object reference (IDOR) vulnerability in Raft cluster-info endpoints (CVE-2026-75839) affects HA clusters, allowing unauthenticated access to sensitive cluster information.
ArcadeDB addressed these vulnerabilities in version 26.8.1. Users are strongly advised to update to this version to mitigate the risks associated with these critical authentication and authorization flaws. The widespread nature of these issues across multiple protocols and handlers underscores the importance of timely patching and thorough security reviews for database systems.
The batch of vulnerabilities was disclosed on August 18, 2026. All affected versions are prior to 26.8.1. The fix is available in version 26.8.1.
Key findings include:
- Critical vulnerabilities (up to CVSSv3 9.9) in Redis, MongoDB plugins, and async command handling.
- High-severity flaws include authorization bypasses, SSRF, and arbitrary file reads.
- Multiple issues stem from failure to propagate authenticated principals or enforce authorization checks.
- All disclosed vulnerabilities are fixed in ArcadeDB version 26.8.1.
- Exploitable flaws include unauthenticated data access and arbitrary file reads.
CVEs included in this disclosure: CVE-2026-75854, CVE-2026-75853, CVE-2026-75852, CVE-2026-75851, CVE-2026-75850, CVE-2026-75846, CVE-2026-75845, CVE-2026-75844, CVE-2026-75843, CVE-2026-75842, CVE-2026-75841, CVE-2026-75840, CVE-2026-75839.