CVE-2026-68578 affects ArcadeDB versions prior to 26.7.3 by failing to bind the authenticated principal in the MCP HTTP transport layer. This flaw causes all engine permission checks to effectively become no-ops, enabling non-root users with MCP access to bypass authorization controls. Exploitation allows arbitrary database writes, data definition language (DDL) operations, schema mutations, and execution of arbitrary JavaScript code through the query tool interface. The vulnerability is rated high severity with a CVSS 4.0 base score of 7.7, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but partial user interaction.

The vulnerability allows non-root MCP-allowed users to bypass all permission checks silently, resulting in unauthorized arbitrary writes to the database, schema modifications, and execution of arbitrary JavaScript code. This can lead to significant data integrity and availability issues, as well as potential code execution within the database environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict MCP access to fully trusted users only and monitor for unusual activity related to database writes and schema changes. Avoid exposing the MCP HTTP transport interface to untrusted networks or users.