EUVD-2026-60613
GHSA-xgx7-2w7q-r9mc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable listener on 27017 with no enforced authentication gives unauthenticated full CRUD, so AV:N/AC:L/PR:N/UI:N and high C/I/A; scope unchanged as impact stays within the database service.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials.
AnalysisAI
Authentication bypass in ArcadeDB before 26.8.1 lets unauthenticated attackers run full CRUD operations against any database through the MongoDB wire-protocol plugin on TCP port 27017. The plugin negotiates a SASL handshake but never actually enforces it on data commands (insert, find, update, delete, create), so an attacker who can reach the port gains complete read/write access with no credentials. Reported by VulnCheck; no public exploit code has been identified at time of analysis, though the trivial reproduction path makes weaponization straightforward.
Technical ContextAI
ArcadeDB is a multi-model (graph, document, key-value, time-series) database that exposes several network protocol front-ends, including a MongoDB-compatible endpoint that speaks the MongoDB wire protocol so existing Mongo drivers can talk to it. The flaw is a CWE-306 (Missing Authentication for Critical Function): the SASL authentication step in this plugin is offered during connection negotiation but is not enforced as a precondition for executing data commands. As a result the authorization gate is effectively decorative - commands are processed on the basis of protocol framing alone. The CPE cpe:2.3:a:arcadedata:arcadedb:*:*:*:*:*:*:*:* covers all ArcadeDB releases prior to the fixed 26.8.1. Because the affected surface is the network listener on 27017, the vulnerable code path is reachable by anyone with TCP connectivity to that port.
RemediationAI
Vendor-released patch: upgrade to ArcadeDB 26.8.1 or later, which enforces SASL authentication on data commands in the MongoDB wire-protocol plugin; this is the primary and complete fix per the GHSA-fq9c-x968-g278 advisory. If immediate patching is not possible, disable the MongoDB protocol plugin entirely where it is not required (trade-off: any legitimate Mongo-driver clients lose connectivity), and/or firewall TCP port 27017 so it is reachable only from trusted application hosts rather than being network- or internet-exposed (trade-off: must enumerate and allowlist legitimate clients, and this does not protect against an attacker already inside the trusted network segment). Because authentication is not enforced pre-patch, network isolation of 27017 is the only reliable compensating control until 26.8.1 is deployed. Consult the vendor advisory (https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-fq9c-x968-g278) and VulnCheck writeup (https://www.vulncheck.com/advisories/arcadedb-mongodb-wire-protocol-authentication-bypass-cross-database) for confirmation.
Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exp
Privilege escalation in ArcadeDB server (versions 26.7.3 and earlier) allows a low-privileged authenticated user with re
Privilege escalation in ArcadeDB before 26.8.1 lets a low-privileged authenticated reader escalate to full server admini
Scripting authorization bypass in ArcadeDB before 26.7.2 lets any authenticated database user - including read-only role
Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the s
Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version
Cross-database authorization bypass in ArcadeDB's Gremlin wire-protocol plugin allows any authenticated server user to f
Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to
Cluster token exposure in ArcadeDB before 26.7.2 enables any authenticated user to escalate privileges to root-level adm
Privilege escalation in ArcadeDB before 26.7.3 allows any user holding UPDATE_SCHEMA permission to create server-wide ad
Remote OS command execution in ArcadeDB before 26.7.2 is reachable by authenticated schema administrators through JavaSc
Authenticated low-privilege users can read and insert TimeSeries samples in ArcadeDB deployments running versions before
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today