CVE-2026-67357: Exposure of Sensitive Information to an Unauthorized Actor in ArcadeData arcadedb
ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that leaks the arcadedb.ha.clusterToken in cleartext. Attackers with MCP access can retrieve the cluster token and use it with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate root and achieve full server compromise.
AI Analysis
Technical Summary
CVE-2026-67357 is an information disclosure vulnerability affecting ArcadeDB versions prior to 26.7.3. The flaw exists in the MCP get_server_settings tool, which leaks the arcadedb.ha.clusterToken in cleartext. An attacker with access to the MCP interface can extract this cluster token and use it in the X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate the root user. This impersonation can lead to full server compromise. The vulnerability has a CVSS 4.0 base score of 7.7, indicating high severity. There is no vendor advisory or patch link currently available, and the remediation level is unknown.
Potential Impact
An attacker with MCP access can obtain the cluster token and use it to impersonate the root user, resulting in full server compromise. This could allow unauthorized access and control over the affected ArcadeDB server.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict MCP access to trusted users only to prevent unauthorized retrieval of the cluster token.
CVE-2026-67357: Exposure of Sensitive Information to an Unauthorized Actor in ArcadeData arcadedb
Description
ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that leaks the arcadedb.ha.clusterToken in cleartext. Attackers with MCP access can retrieve the cluster token and use it with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate root and achieve full server compromise.
CVSS v4.0
Score 7.7high
Affected software
ArcadeData
arcadedb
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-67357 is an information disclosure vulnerability affecting ArcadeDB versions prior to 26.7.3. The flaw exists in the MCP get_server_settings tool, which leaks the arcadedb.ha.clusterToken in cleartext. An attacker with access to the MCP interface can extract this cluster token and use it in the X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate the root user. This impersonation can lead to full server compromise. The vulnerability has a CVSS 4.0 base score of 7.7, indicating high severity. There is no vendor advisory or patch link currently available, and the remediation level is unknown.
Potential Impact
An attacker with MCP access can obtain the cluster token and use it to impersonate the root user, resulting in full server compromise. This could allow unauthorized access and control over the affected ArcadeDB server.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict MCP access to trusted users only to prevent unauthorized retrieval of the cluster token.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-07-29T13:36:36.278Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a6f3c9fbf32cb7a348adf6d
Added to database: 08/02/2026, 12:48:31 UTC
Last enriched: 08/09/2026, 14:15:28 UTC
Last updated: 09/14/2026, 22:01:36 UTC
Views: 54
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.