CVE-2026-68578: Missing Authentication for Critical Function in ArcadeData arcadedb
ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via the query tool.
AI Analysis
Technical Summary
CVE-2026-68578 affects ArcadeDB versions before 26.7.3 by failing to bind the authenticated principal in the MCP HTTP transport layer. This flaw causes permission checks within the database engine to be no-ops, effectively allowing non-root MCP-allowed users to bypass access controls. Exploitation enables arbitrary database writes, data definition language (DDL) operations, schema mutations, and execution of arbitrary JavaScript code through the query interface.
Potential Impact
The vulnerability allows non-root users with MCP permissions to bypass all engine permission checks, leading to unauthorized data manipulation and code execution within the database. This can compromise database integrity and confidentiality by allowing arbitrary writes, schema changes, and execution of JavaScript code, potentially leading to full compromise of the database environment.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict MCP access to fully trusted users only and monitor for suspicious activity related to database writes and schema changes.
CVE-2026-68578: Missing Authentication for Critical Function in ArcadeData arcadedb
Description
ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via the query tool.
CVSS v4.0
Score 7.7high
Affected software
ArcadeData
arcadedb
pkg:github/arcadedata/arcadedbRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-68578 affects ArcadeDB versions before 26.7.3 by failing to bind the authenticated principal in the MCP HTTP transport layer. This flaw causes permission checks within the database engine to be no-ops, effectively allowing non-root MCP-allowed users to bypass access controls. Exploitation enables arbitrary database writes, data definition language (DDL) operations, schema mutations, and execution of arbitrary JavaScript code through the query interface.
Potential Impact
The vulnerability allows non-root users with MCP permissions to bypass all engine permission checks, leading to unauthorized data manipulation and code execution within the database. This can compromise database integrity and confidentiality by allowing arbitrary writes, schema changes, and execution of JavaScript code, potentially leading to full compromise of the database environment.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict MCP access to fully trusted users only and monitor for suspicious activity related to database writes and schema changes.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-07-31T11:56:29.759Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a6f3c9fbf32cb7a348adf71
Added to database: 08/02/2026, 12:48:31 UTC
Last enriched: 08/09/2026, 14:22:20 UTC
Last updated: 09/16/2026, 12:21:43 UTC
Views: 62
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.