EUVD-2026-51843
GHSA-3cc2-w6p6-c4vg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L because any authenticated user can trigger it; S:C because the attack chain breaks out of the user's privilege boundary to impersonate root across the full system.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing authenticated users to retrieve the arcadedb.ha.clusterToken value in cleartext. Attackers can use the leaked token with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate root and execute administrative actions including user creation, database operations, and server shutdown.
AnalysisAI
Cluster token exposure in ArcadeDB before 26.7.2 enables any authenticated user to escalate privileges to root-level administrative control. The GET /api/v1/server management endpoint returns the arcadedb.ha.clusterToken value in cleartext, which an attacker can replay via the X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User HTTP headers to impersonate the root account. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid ArcadeDB user account at any privilege level - the GET /api/v1/server endpoint is accessible to all authenticated users, not just administrators. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) accurately reflects the high real-world severity for deployments where any authenticated user exists who should not have root access. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a low-privileged ArcadeDB account issues a GET request to /api/v1/server and parses the JSON response to extract the arcadedb.ha.clusterToken value in cleartext. The attacker then crafts subsequent HTTP requests to administrative API endpoints, setting the X-ArcadeDB-Cluster-Token header to the stolen token and the X-ArcadeDB-Forwarded-User header to the root username, bypassing all authorization checks. … |
| Remediation | Upgrade ArcadeDB to version 26.7.2 or later, which is the vendor-confirmed fixed release per EUVD-2026-51843 and the GitHub security advisory GHSA-46hj-24h4-j8gf. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all ArcadeDB deployments running versions before 26.7.2 and immediately restrict access to the GET /api/v1/server endpoint to administrative users only, as it exposes the cluster token in cleartext. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
OS command execution in ArcadeDB (arcadedb-engine) before 26.7.2 lets an authenticated user with UPDATE_SCHEMA permissio
Scripting authorization bypass in ArcadeDB before 26.7.2 lets any authenticated database user - including read-only role
Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the s
Privilege escalation in ArcadeDB before 26.7.3 allows any user holding UPDATE_SCHEMA permission to create server-wide ad
Permission bypass in ArcadeDB before 26.7.2 allows authenticated read-only users to execute privileged schema-mutation S
Privilege escalation in ArcadeDB before 26.7.3 allows any authenticated MCP user to fully bypass the database authorizat
Cleartext leakage of the HA cluster token in ArcadeDB's MCP get_server_settings tool allows any authenticated MCP user t
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today