CVE-2026-68578 ArcadeData CVE debrief

Who should care

Organizations using ArcadeDB, especially those with high-security requirements, should be aware of this vulnerability. The vulnerability's impact could be significant, allowing attackers to perform arbitrary database writes and execute JavaScript code. Security teams and operators should review their deployments and assess potential exposure.

Technical summary

ArcadeDB versions before 26.7.3 have an authentication bypass vulnerability in the MCP HTTP transport. This vulnerability allows non-root users to perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code. The vulnerability is due to the failure to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops.

Defensive priority

Organizations using ArcadeDB should prioritize patching to prevent potential arbitrary database writes and code execution.

Recommended defensive actions

• Apply patches or updates to ArcadeDB to version 26.7.3 or later
• Restrict access to the MCP HTTP transport
• Monitor for suspicious database activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The evidence for this CVE is limited. Further verification is needed to confirm affected versions and scope. Defenders should verify ArcadeDB deployments, review version numbers, and assess potential exposure. The CVE record indicates that ArcadeDB versions before 26.7.3 are affected, but additional details are required to fully understand the vulnerability's impact.

Official resources