CVE-2026-75852: Missing Authentication for Critical Function in ArcadeData arcadedb
ArcadeDB versions before 26.8.1 have a critical vulnerability where the MongoDB wire-protocol plugin does not enforce SASL authentication on data commands. This allows unauthenticated attackers to perform insert, find, update, delete, and create operations on any database by connecting to port 27017 without credentials.
AI Analysis
Technical Summary
CVE-2026-75852 is a critical security vulnerability in ArcadeDB prior to version 26.8.1. The flaw is due to missing enforcement of SASL authentication on data commands within the MongoDB wire-protocol plugin. As a result, attackers can connect unauthenticated to the database service on port 27017 and execute various data manipulation commands such as insert, find, update, delete, and create against any database instance.
Potential Impact
The vulnerability allows unauthenticated remote attackers to fully manipulate database contents, including reading, modifying, deleting, and creating data without any credentials. This can lead to data compromise, loss of integrity, and potential disruption of services relying on the database.
Mitigation Recommendations
Upgrade ArcadeDB to version 26.8.1 or later, where SASL authentication enforcement on the MongoDB wire-protocol plugin is implemented. No other mitigations are indicated. Patch status is confirmed by the version boundary provided.
CVE-2026-75852: Missing Authentication for Critical Function in ArcadeData arcadedb
Description
ArcadeDB versions before 26.8.1 have a critical vulnerability where the MongoDB wire-protocol plugin does not enforce SASL authentication on data commands. This allows unauthenticated attackers to perform insert, find, update, delete, and create operations on any database by connecting to port 27017 without credentials.
CVSS v4.0
Score 9.3critical
Affected software
ArcadeData
arcadedb
pkg:github/arcadedata/arcadedbRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-75852 is a critical security vulnerability in ArcadeDB prior to version 26.8.1. The flaw is due to missing enforcement of SASL authentication on data commands within the MongoDB wire-protocol plugin. As a result, attackers can connect unauthenticated to the database service on port 27017 and execute various data manipulation commands such as insert, find, update, delete, and create against any database instance.
Potential Impact
The vulnerability allows unauthenticated remote attackers to fully manipulate database contents, including reading, modifying, deleting, and creating data without any credentials. This can lead to data compromise, loss of integrity, and potential disruption of services relying on the database.
Mitigation Recommendations
Upgrade ArcadeDB to version 26.8.1 or later, where SASL authentication enforcement on the MongoDB wire-protocol plugin is implemented. No other mitigations are indicated. Patch status is confirmed by the version boundary provided.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-18T11:03:08.681Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a844369c6e8be033222977a
Added to database: 08/18/2026, 11:35:05 UTC
Last enriched: 09/11/2026, 22:18:57 UTC
Last updated: 10/02/2026, 02:46:06 UTC
Views: 56
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.