EUVD-2026-51843
GHSA-3cc2-w6p6-c4vg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L because any authenticated user can trigger it; S:C because the attack chain breaks out of the user's privilege boundary to impersonate root across the full system.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing authenticated users to retrieve the arcadedb.ha.clusterToken value in cleartext. Attackers can use the leaked token with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate root and execute administrative actions including user creation, database operations, and server shutdown.
AnalysisAI
Cluster token exposure in ArcadeDB before 26.7.2 enables any authenticated user to escalate privileges to root-level administrative control. The GET /api/v1/server management endpoint returns the arcadedb.ha.clusterToken value in cleartext, which an attacker can replay via the X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User HTTP headers to impersonate the root account. This two-stage privilege escalation grants full administrative capabilities including user creation, arbitrary database operations, and server shutdown - representing a near-total system compromise for any multi-tenant or shared ArcadeDB deployment. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the exploitation path is mechanically trivial once credentials are obtained.
Technical ContextAI
ArcadeDB is an open-source multi-model NoSQL database with built-in high-availability (HA) clustering support. Cluster node authentication relies on a shared secret - arcadedb.ha.clusterToken - to authorize inter-node communications. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the GET /api/v1/server REST management endpoint surfaces server configuration data without masking or redacting the cluster token. Once an attacker possesses this token, the X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers can be injected into subsequent requests to bypass normal authorization checks entirely and impersonate the root user. The affected CPE is cpe:2.3:a:arcadedata:arcadedb:*:*:*:*:*:*:*:*, spanning all versions from 0 up to (but not including) 26.7.2. The vulnerability is architectural: the same credential used for intra-cluster trust is readable by ordinary application users, collapsing the privilege boundary between authenticated users and administrators.
RemediationAI
Upgrade ArcadeDB to version 26.7.2 or later, which is the vendor-confirmed fixed release per EUVD-2026-51843 and the GitHub security advisory GHSA-46hj-24h4-j8gf. The fix presumably redacts the arcadedb.ha.clusterToken value in the GET /api/v1/server API response. If immediate upgrade is not feasible, restrict network-level or application-level access to the GET /api/v1/server endpoint so that only administrators can call it - this eliminates the information disclosure step and breaks the attack chain. As a post-patch hygiene measure, rotate the arcadedb.ha.clusterToken value if low-privileged users had access to the endpoint prior to patching, since any previously retrieved tokens remain valid until regenerated. The advisory is available at https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-46hj-24h4-j8gf.
Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exp
Privilege escalation in ArcadeDB server (versions 26.7.3 and earlier) allows a low-privileged authenticated user with re
Privilege escalation in ArcadeDB before 26.8.1 lets a low-privileged authenticated reader escalate to full server admini
Authentication bypass in ArcadeDB before 26.8.1 lets unauthenticated attackers run full CRUD operations against any data
Scripting authorization bypass in ArcadeDB before 26.7.2 lets any authenticated database user - including read-only role
Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the s
Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version
Cross-database authorization bypass in ArcadeDB's Gremlin wire-protocol plugin allows any authenticated server user to f
Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to
Privilege escalation in ArcadeDB before 26.7.3 allows any user holding UPDATE_SCHEMA permission to create server-wide ad
Remote OS command execution in ArcadeDB before 26.7.2 is reachable by authenticated schema administrators through JavaSc
Permission bypass in ArcadeDB before 26.7.2 allows authenticated read-only users to execute privileged schema-mutation S
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today