EUVD-2026-51988
GHSA-hq22-48ph-vqch
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector with low privilege reflects authenticated MCP user entry point; AC:H accounts for MCP transport requiring explicit enablement and reachability as a precondition.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via the query tool.
AnalysisAI
Privilege escalation in ArcadeDB before 26.7.3 allows any authenticated MCP user to fully bypass the database authorization framework. The MCP HTTP transport layer fails to bind the authenticated principal into the engine's permission context, causing all access control checks to silently resolve as no-ops regardless of the user's actual role. Affected users can perform arbitrary DDL, schema mutations, unrestricted database writes, and execute arbitrary JavaScript via the query tool - effectively gaining root-level database access from a low-privileged account. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, though the impact is severe for any deployment with MCP transport enabled.
Technical ContextAI
ArcadeDB (cpe:2.3:a:arcadedata:arcadedb) is a multi-model NoSQL database engine that supports a Model Context Protocol (MCP) HTTP transport, a mechanism designed to allow AI agents and LLM tool integrations to interact directly with the database engine. CWE-306 (Missing Authentication for Critical Function) describes the root cause precisely: the authenticated identity established at the HTTP transport boundary is never propagated into ArcadeDB's internal engine permission layer. As a result, the engine evaluates every inbound MCP request with no bound principal, causing its role-based permission checks to pass unconditionally. This is particularly dangerous in AI-augmented environments where MCP clients - such as LLM orchestration frameworks - may hold credentials that should enforce tight query boundaries but instead gain unrestricted engine access.
RemediationAI
The primary fix is upgrading to ArcadeDB version 26.7.3 or later, which resolves the missing principal binding in the MCP HTTP transport. The vendor advisory is published at https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-6x73-v3rc-f57c. If immediate upgrade is not possible, the most effective compensating control is to disable the MCP HTTP transport entirely, as the vulnerability is specific to that interface; disabling it has no effect on standard database operations over the HTTP REST or binary protocols. If MCP must remain active, restrict network-level access to the MCP endpoint via firewall rules or an API gateway, accepting that this reduces but does not eliminate risk from already-authenticated internal users. Additionally, audit and minimize the set of accounts with MCP access, restricting it to the smallest trusted set - this limits the attacker pool to those users who already hold MCP-enabled credentials. Note that none of these compensating controls address the root authorization bypass; only patching to 26.7.3+ fully remediates the flaw.
Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exp
Privilege escalation in ArcadeDB server (versions 26.7.3 and earlier) allows a low-privileged authenticated user with re
Privilege escalation in ArcadeDB before 26.8.1 lets a low-privileged authenticated reader escalate to full server admini
Authentication bypass in ArcadeDB before 26.8.1 lets unauthenticated attackers run full CRUD operations against any data
Scripting authorization bypass in ArcadeDB before 26.7.2 lets any authenticated database user - including read-only role
Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the s
Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version
Cross-database authorization bypass in ArcadeDB's Gremlin wire-protocol plugin allows any authenticated server user to f
Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to
Cluster token exposure in ArcadeDB before 26.7.2 enables any authenticated user to escalate privileges to root-level adm
Privilege escalation in ArcadeDB before 26.7.3 allows any user holding UPDATE_SCHEMA permission to create server-wide ad
Remote OS command execution in ArcadeDB before 26.7.2 is reachable by authenticated schema administrators through JavaSc
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today