EUVD-2026-60613
GHSA-xgx7-2w7q-r9mc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable listener on 27017 with no enforced authentication gives unauthenticated full CRUD, so AV:N/AC:L/PR:N/UI:N and high C/I/A; scope unchanged as impact stays within the database service.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials.
AnalysisAI
Authentication bypass in ArcadeDB before 26.8.1 lets unauthenticated attackers run full CRUD operations against any database through the MongoDB wire-protocol plugin on TCP port 27017. The plugin negotiates a SASL handshake but never actually enforces it on data commands (insert, find, update, delete, create), so an attacker who can reach the port gains complete read/write access with no credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The exploitable prerequisite is that the ArcadeDB MongoDB wire-protocol plugin is enabled and its listener on TCP port 27017 is reachable by the attacker; given AV:N/AC:L/AT:N/PR:N/UI:N, no authentication, no user interaction, and no non-default trickery beyond that plugin being active are needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue, not an inflated-CVSS artifact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker scans for exposed TCP port 27017, connects with a standard MongoDB driver, and skips authentication entirely because the SASL step is not enforced. They then enumerate every database on the instance and issue find commands to exfiltrate sensitive records, followed by update or delete commands to tamper with or destroy data. … |
| Remediation | Vendor-released patch: upgrade to ArcadeDB 26.8.1 or later, which enforces SASL authentication on data commands in the MongoDB wire-protocol plugin; this is the primary and complete fix per the GHSA-fq9c-x968-g278 advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: implement firewall rules blocking all external access to port 27017 and restricting to whitelisted trusted IPs only; disable the MongoDB wire-protocol plugin if not essential to business operations; inventory all ArcadeDB deployments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
OS command execution in ArcadeDB (arcadedb-engine) before 26.7.2 lets an authenticated user with UPDATE_SCHEMA permissio
Privilege escalation in ArcadeDB server (versions 26.7.3 and earlier) allows a low-privileged authenticated user with re
Privilege escalation in ArcadeDB before 26.8.1 lets a low-privileged authenticated reader escalate to full server admini
Scripting authorization bypass in ArcadeDB before 26.7.2 lets any authenticated database user - including read-only role
Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the s
Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exp
Cluster token exposure in ArcadeDB before 26.7.2 enables any authenticated user to escalate privileges to root-level adm
Privilege escalation in ArcadeDB before 26.7.3 allows any user holding UPDATE_SCHEMA permission to create server-wide ad
Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version
Cross-database authorization bypass in ArcadeDB's Gremlin wire-protocol plugin allows any authenticated server user to f
Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to
Permission bypass in ArcadeDB before 26.7.2 allows authenticated read-only users to execute privileged schema-mutation S
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today