ArcadeDB CVE-2026-75845

Exploitation requires three simultaneous conditions: (1) ArcadeDB is deployed with an MCP server interface enabled; (2) the MCP deployment's global allowAdmin flag is set to true; and (3) the allowedUsers configuration includes at least one non-root, non-administrative user account (i.e., a mixed-privilege deployment). The attacker must possess valid credentials for any user in that allowedUsers list, including read-only accounts. What limits exploitation: deployments where allowAdmin=false are not exploitable via this path regardless of user roles; deployments where all allowedUsers hold admin roles are not meaningfully affected; and non-MCP ArcadeDB deployments are entirely outside the vulnerable code path. Network access to the MCP server endpoint is required.

The CVSS 4.0 score of 5.3 with vector AV:N/AC:L/AT:N/PR:L/UI:N reflects network-accessible exploitation requiring only low-privilege authentication with no additional attack preconditions (AT:N) and no user interaction. The vendor-assigned impact metrics (VC:L/VI:L/VA:L) appear conservative given that unrestricted writes to GlobalConfiguration can alter security-relevant settings or induce service instability. My independent assessment raises integrity and availability to H because GlobalConfiguration governs server-wide runtime behavior. Exploitation conditions are specific - both allowAdmin=true and a non-root, mixed-privilege allowedUsers configuration must be present simultaneously - which meaningfully constrains real-world exposure beyond the raw network-accessible vector. No active exploitation is confirmed (not in CISA KEV), no public POC has been identified, and EPSS data was not provided in the source intelligence. This is a real priority for organizations running ArcadeDB in MCP mode with non-admin users, but unlikely to be opportunistically mass-exploited given the deployment-specific prerequisites.

An attacker with valid read-only credentials for an ArcadeDB MCP deployment (allowAdmin=true, non-admin allowedUsers configured) sends a set_server_setting MCP tool invocation over the network. Because SetServerSettingTool.execute() only checks the allowAdmin flag - which is true - and never inspects the caller's role, the request succeeds and the attacker modifies a GlobalConfiguration entry such as a thread-pool size or timeout value to degrade service availability or alter security-relevant runtime behavior.