Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: ArcadeData arcadedb 26.7.3 Clear all filters
TI-2026-48318 CVE-2026-68578 · GHSA-hq22-48ph-vqch

ArcadeDB before 26.7.3 Authentication Bypass via MCP Transport

Priority LOW 36

ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.00363 Published 2026-08-02 Fixed in 26.7.3 CWE-306
TI-2026-47653 CVE-2026-67357 · GHSA-7qj8-rw8h-hhxv

ArcadeDB before 26.7.3 Information Disclosure via get_server_settings

Priority LOW 36

ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that leaks the arcadedb.ha.clusterToken in cleartext.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.00424 Published 2026-08-02 Fixed in 26.7.3 CWE-200
TI-2026-47652 CVE-2026-67356 · GHSA-p28w-g8xf-vm54

ArcadeDB before 26.7.3 Privilege Escalation via JavaScript Trigger

Priority MEDIUM 40

ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins to call getSecurity().createUser() without permission checks.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00442 Published 2026-08-02 Fixed in 26.7.3 CWE-269