ArcadeDB CVE-2026-68578

Exploitation requires three specific conditions to align: (1) the target ArcadeDB instance must have the MCP HTTP transport enabled and network-accessible from the attacker's position; (2) the attacker must hold a valid, authenticated ArcadeDB account that is permitted to use the MCP interface; (3) the instance must be running a version prior to 26.7.3. Unauthenticated attackers cannot exploit this flaw - a valid low-privilege MCP credential is the minimum entry point. The CVSS 4.0 AC:H and AT:P modifiers reflect that MCP transport enablement is not the default operational mode for most ArcadeDB deployments and must be explicitly configured. Exploitation is scoped entirely to the vulnerable ArcadeDB instance, with no evidence of scope change to adjacent systems (SC:N/SI:N/SA:N). The limiting factors for defenders are: organizations that do not use the MCP transport are not exposed, and those that restrict MCP network access to trusted internal clients significantly reduce the realistic attacker pool.

The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) scores 7.7 and reflects a genuine but conditioned risk: the attack is network-reachable and requires only low privileges, but AC:H and AT:P signal that specific preconditions must be met - namely, the MCP HTTP transport must be enabled, reachable, and the attacker must hold a valid MCP-enabled account. All three impact dimensions are rated High, reflecting total compromise of the database's confidentiality, integrity, and availability within the vulnerable system. No EPSS data was provided and this CVE is absent from CISA KEV, suggesting no confirmed widespread active exploitation. No POC code has been identified. The absence of scope change (SC:N/SI:N/SA:N) bounds the blast radius to the ArcadeDB instance itself, limiting lateral movement risk. Overall: this is a high-priority fix for organizations running ArcadeDB with MCP enabled, but the AC:H/AT:P modifiers meaningfully reduce the pool of exploitable deployments compared to a simpler network-accessible unauthenticated flaw.

An attacker who holds a low-privileged ArcadeDB account granted MCP access connects to the MCP HTTP transport endpoint and submits a DDL statement or a JavaScript execution query via the MCP query tool. Because the transport never binds the caller's identity into the engine context, all permission checks resolve as no-ops and the query executes with full engine privileges - allowing the attacker to drop or alter schemas, read any data, overwrite records, or run arbitrary JavaScript within the database runtime. No public exploit code has been identified, but the attack path is mechanically straightforward for any valid MCP-enabled credential holder.