CVE-2026-68578: ArcadeDB before 26.7.3 Authentication Bypass via MCP Transport

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-02 · updated 2026-10-23
Weakness: CWE-306

Description

ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via the query tool.

Affected products

ArcadeData arcadedb: before 26.7.3 — fixed in 26.7.3

How to fix

Upgrade to a fixed version: ArcadeData arcadedb 26.7.3. Check the vendor advisory for mitigations.

References

https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-6x73-v3rc-f57c
https://www.vulncheck.com/advisories/arcadedb-authentication-bypass-via-mcp-transport
https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-6x73-v3rc-f57c

Get alerted when CVE-2026-68578 or the next vulnerability affects your stack