Which versions of ArcadeDB are affected by CVE-2026-75854?

ArcadeDB versions before 26.8.1 with the Redis wire-protocol plugin enabled allow unauthenticated remote attackers to read, write, and delete all database records, creating immediate risk of data…. A patch is available.

How to fix or mitigate CVE-2026-75854?

Within 24 hours: inventory all ArcadeDB instances and identify which expose the Redis wire-protocol plugin to untrusted networks; immediately disable the Redis plugin if not operationally required, or restrict access at the network firewall level to authorized IPs only. Within 7 days: monitor vendor channels for patch availability; when available, test and deploy ArcadeDB 26.8.1 or later to all affected systems; if no patch is released, maintain persistent firewall-level access controls. Within 30 days: audit database access logs from the preceding 90 days for unauthorized access or data manipulation, verify integrity of all backups, and implement continuous network monitoring to detect exploitation attempts.

ArcadeDB CVE-2026-75854

Q: What is the CVSS score of CVE-2026-75854?

CVE-2026-75854 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.1%.

EUVD-2026-60615 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-08-18 VulnCheck

GHSA-hfh9-c87v-cv29

Authentication Bypass Redis Arcadedb Arcadedata

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Network-reachable, unauthenticated Redis plugin with no user interaction gives AV:N/AC:L/PR:N/UI:N; full read/write/delete over databases yields C:H/I:H/A:H, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 18, 2026 - 12:02 EUVD

Analysis Generated

Aug 18, 2026 - 11:59 vuln.today

CVE Published

Aug 18, 2026 - 11:19 cve.org

CRITICAL 9.3

DescriptionCVE.org

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without providing credentials, bypassing all security gates.

Articles & Coverage 2

medium.com CVE-2026-75854: ArcadeDB Redis Wire-Protocol Plugin Authentication Bypass Grants Full Database Access Aug 21, 2026 News Critical Unauthenticated Data Access in ArcadeDB Redis Plugin - CVE-2026-75854 Aug 18, 2026

AnalysisAI

Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exposes no authentication gate, letting anyone who can reach the Redis port read, write, and delete records across any database on the server. VulnCheck reported the flaw (CWE-306, Missing Authentication) with a CVSS 4.0 base score of 9.3, reflecting network-reachable, no-privilege exploitation with high confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

ArcadeDB is an open-source multi-model database that ships optional protocol plugins so clients can speak familiar wire protocols - in this case the Redis serialization protocol (RESP) - against ArcadeDB's storage engine. The vulnerability is a CWE-306 Missing Authentication for a Critical Function: the Redis wire-protocol plugin accepts and executes commands on any database without invoking ArcadeDB's normal security gates (user/password checks and per-database authorization). Per the CPE cpe:2.3:a:arcadedata:arcadedb:*:*:*:*:*:*:*:*, the affected component is the ArcadeDB server application itself when this plugin is enabled and its port is listening.

RemediationAI

Vendor-released patch: 26.8.1 - upgrade ArcadeDB to 26.8.1 or later, as documented in GHSA-m46c-jh3x-xwrp (https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-m46c-jh3x-xwrp). If immediate upgrade is not possible, disable the Redis wire-protocol plugin entirely (removing the unauthenticated command surface, at the cost of losing Redis-protocol client access), or bind the Redis port strictly to localhost and block it at the host/network firewall so only trusted internal callers can reach it (which breaks legitimate remote Redis-protocol clients that rely on it). Restricting access to the Redis port via network segmentation is the highest-value compensating control given the flaw is purely a missing-authentication gate; verify no external interface exposes the port after applying any workaround. See the VulnCheck advisory (https://www.vulncheck.com/advisories/arcadedb-redis-wire-protocol-plugin-missing-authentication) for further detail.