Skip to main content

ArcadeDB CVE-2026-75845

| EUVDEUVD-2026-60609 MEDIUM
Improper Privilege Management (CWE-269)
2026-08-18 VulnCheck GHSA-2c26-2qqv-6r9c
Privilege Escalation Denial Of Service Arcadedb
5.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.1 HIGH

Network-reachable MCP endpoint (AV:N), low-privilege credentials required (PR:L), no user interaction; integrity and availability raised to H because GlobalConfiguration tampering has server-wide scope and can induce DoS.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 18, 2026 - 12:05 vuln.today
Patch available
Aug 18, 2026 - 12:02 EUVD

DescriptionCVE.org

ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the set_server_setting MCP server-level tool. SetServerSettingTool.execute() gates only on the global allowAdmin flag and never checks the caller's role, so in an MCP deployment with allowAdmin=true and a non-root allowedUsers set, any authenticated read-only user can invoke set_server_setting to modify server GlobalConfiguration, enabling configuration tampering or denial of service. The issue is fixed in 26.8.1.

AnalysisAI

Authorization bypass in ArcadeDB's MCP server-level set_server_setting tool allows authenticated read-only users to modify global server configuration in versions 26.4.2 through 26.7.3. SetServerSettingTool.execute() validates only the global allowAdmin flag and omits any role-level check, meaning any user with valid credentials - regardless of their assigned role - can invoke the tool when the MCP deployment is configured with allowAdmin=true and a non-root allowedUsers list. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate as low-privilege MCP user
Delivery
Call set_server_setting tool over network
Exploit
allowAdmin=true gate passes, role check absent
Execution
Write arbitrary GlobalConfiguration value
Impact
Trigger configuration tampering or denial of service
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires three simultaneous conditions: (1) ArcadeDB is deployed with an MCP server interface enabled; (2) the MCP deployment's global allowAdmin flag is set to true; and (3) the allowedUsers configuration includes at least one non-root, non-administrative user account (i.e., a mixed-privilege deployment). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 5.3 with vector AV:N/AC:L/AT:N/PR:L/UI:N reflects network-accessible exploitation requiring only low-privilege authentication with no additional attack preconditions (AT:N) and no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with valid read-only credentials for an ArcadeDB MCP deployment (allowAdmin=true, non-admin allowedUsers configured) sends a set_server_setting MCP tool invocation over the network. Because SetServerSettingTool.execute() only checks the allowAdmin flag - which is true - and never inspects the caller's role, the request succeeds and the attacker modifies a GlobalConfiguration entry such as a thread-pool size or timeout value to degrade service availability or alter security-relevant runtime behavior.
Remediation Upgrade to ArcadeDB 26.8.1, which is the vendor-confirmed patched release per advisory GHSA-pff6-hp53-pj54. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Arcadedb

View all
CVE-2026-75851 CRITICAL
9.4 Aug 18

Privilege escalation in ArcadeDB server (versions 26.7.3 and earlier) allows a low-privileged authenticated user with re
CVE-2026-75843 CRITICAL
9.4 Aug 18

Privilege escalation in ArcadeDB before 26.8.1 lets a low-privileged authenticated reader escalate to full server admini
CVE-2026-67341 CRITICAL
9.3 Aug 01

Scripting authorization bypass in ArcadeDB before 26.7.2 lets any authenticated database user - including read-only role
CVE-2026-67342 CRITICAL
9.3 Aug 01

Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the s
CVE-2026-75854 CRITICAL
9.3 Aug 18

Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exp
CVE-2026-75852 CRITICAL
9.3 Aug 18

Authentication bypass in ArcadeDB before 26.8.1 lets unauthenticated attackers run full CRUD operations against any data
CVE-2026-76224 HIGH
8.7 Aug 19

Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version
CVE-2026-67343 HIGH
8.7 Aug 01

Cluster token exposure in ArcadeDB before 26.7.2 enables any authenticated user to escalate privileges to root-level adm
CVE-2026-67356 HIGH
8.7 Aug 02

Privilege escalation in ArcadeDB before 26.7.3 allows any user holding UPDATE_SCHEMA permission to create server-wide ad
CVE-2026-67340 HIGH
8.6 Aug 01

Remote OS command execution in ArcadeDB before 26.7.2 is reachable by authenticated schema administrators through JavaSc
CVE-2026-75853 HIGH
8.7 Aug 18

Cross-database authorization bypass in ArcadeDB's Gremlin wire-protocol plugin allows any authenticated server user to f
CVE-2026-75840 HIGH
8.7 Aug 18

Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to

Same weakness CWE-269 – Improper Privilege Management

View all
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8
CVE-2012-3993 CRITICAL POC
9.3
CVE-2017-11467 CRITICAL POC
9.8
CVE-2014-1510 CRITICAL POC
9.8
CVE-2014-1511 CRITICAL POC
9.8
CVE-2019-1405 HIGH POC
7.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Share

CVE-2026-75845 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy