Threats tagged 'ghsa-hq22-48ph-vqch'

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
High	7.7	EPSS 0.4%	CVE-2026-68578ArcadeData arcadedb · Missing Authentication High7.7EPSS 0.4%2026-08-02CVE Database V5CVE-2026-68578 ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via the query tool. EPSS 0.4%Vulnerability #ghsa-hq22-48ph-vqch	CVE Database V5	2026-08-02

Page 1 of 1