CVE-2026-67343 ArcadeData CVE debrief

Who should care

Administrators and users of ArcadeDB versions before 26.7.2 should be aware of this vulnerability and take necessary actions to mitigate it. Affected operators, platforms, and security teams should review and update ArcadeDB versions, restrict access to the GET /api/v1/server endpoint, and monitor for suspicious activity related to the leaked cluster token.

Technical summary

The vulnerability exists in ArcadeDB versions before 26.7.2, where the cluster token is not properly redacted in the GET /api/v1/server endpoint. This allows authenticated users to retrieve the arcadedb.ha.clusterToken value in cleartext, which can be used to impersonate root and execute administrative actions, including user creation, database operations, and server shutdown. The leaked token can be used with specific headers to impersonate root and execute administrative actions.

Defensive priority

Authenticated users with limited privileges could potentially exploit this vulnerability to gain elevated access.

Recommended defensive actions

• Review and update ArcadeDB versions to 26.7.2 or later
• Restrict access to the GET /api/v1/server endpoint
• Monitor for suspicious activity related to the leaked cluster token
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation is needed to determine the full scope of the vulnerability and potential mitigations. The cluster token leak allows authenticated users to impersonate root and execute administrative actions, including user creation, database operations, and server shutdown. Evidence is limited, and defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Official resources