CVE-2026-68578
published 2026-08-02CVE-2026-68578: ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as…
PriorityP348high7.5CVSS 3.1
AVNACHPRLUINSUCHIHAH
EPSS
0.21%
12.0th percentile
ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via the query tool.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| arcadedata | arcadedb | < 26.7.3 | 26.7.3 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.07.7HIGHCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
ArcadeData ArcadeDB up to 26.7.2 MCP HTTP Transport permission (EUVD-2026-51988)
vuldb·2026-08-02·CVSS 7.5
CVE-2026-68578 [HIGH] ArcadeData ArcadeDB up to 26.7.2 MCP HTTP Transport permission (EUVD-2026-51988)
A vulnerability, which was classified as critical, has been found in ArcadeData ArcadeDB up to 26.7.2. Affected is an unknown function of the component MCP HTTP Transport. This manipulation causes permission issues.
This vulnerability is handled as CVE-2026-68578. The attack can be initiated remotely. There is not any exploit available.
It is advisable to upgrade the affected component.
GHSA
ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops.
ghsa_unreviewed·2026-08-02
CVE-2026-68578 [HIGH] CWE-306 ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops.
ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via the query tool.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-02
Published