CVE-2026-75839 ArcadeData CVE debrief

Who should care

Organizations using ArcadeDB versions <= 26.7.3, especially those with high availability (HA) clusters enabled, should prioritize upgrading to version 26.8.1 or later to mitigate this vulnerability. Security teams and database administrators responsible for ArcadeDB installations should assess their exposure and implement necessary defensive measures.

Technical summary

The CVE-2026-75839 vulnerability affects ArcadeDB versions <= 26.7.3 and allows authenticated users to enumerate the full server database registry and retrieve per-database metadata due to an insecure direct object reference (IDOR) vulnerability in the Raft cluster-info endpoints (GetClusterHandler and PostBootstrapStateHandler). This results in cross-database information disclosure on ArcadeDB HA clusters when arcadedb.ha.enabled is set and the ha-raft module is loaded.

Defensive priority

Authenticated users with limited access can potentially exploit this vulnerability to gain unauthorized access to sensitive database information.

Recommended defensive actions

• Inventory and assess ArcadeDB installations for version <= 26.7.3 and ensure upgrade to 26.8.1 or later.
• Restrict access to Raft cluster-info endpoints to only authorized users.
• Monitor for suspicious activity on ArcadeDB clusters, especially those with high availability (HA) enabled.
• Implement compensating controls such as web application firewalls to detect and prevent potential exploitation attempts.
• Verify and enforce proper configuration of arcadedb.ha.enabled and ha-raft module loading.

Evidence notes

The CVE-2026-75839 vulnerability affects ArcadeDB versions <= 26.7.3 and allows authenticated users to enumerate the full server database registry and retrieve per-database metadata due to an insecure direct object reference (IDOR) vulnerability in the Raft cluster-info endpoints. Evidence is based on official CVE Program record, NVD vulnerability detail, and source references from [email protected].

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.