CVE-2026-75845 ArcadeData CVE debrief

Who should care

Defenders responsible for MCP deployments with ArcadeDB versions 26.4.2 through 26.7.3, especially those with allowAdmin=true and non-root allowedUsers set, should assess exposure and apply the fix.

Why it matters

CVE-2026-75845 is an authorization bypass vulnerability in ArcadeDB that allows authenticated read-only users to modify server GlobalConfiguration, potentially enabling configuration tampering or denial of service. Defenders should prioritize verifying exposure and applying the fix.

• Configuration tampering: an attacker could modify server GlobalConfiguration.
• Denial of service: an attacker could potentially cause service disruption.
• Verification priority: defenders should verify exposure in MCP deployments.

Technical summary

The set_server_setting MCP server-level tool in ArcadeDB versions 26.4.2 through 26.7.3 does not check the caller's role, allowing any authenticated read-only user to modify server GlobalConfiguration when allowAdmin=true and a non-root allowedUsers set. The vulnerability enables configuration tampering or denial of service. The issue is fixed in version 26.8.1. Defenders should prioritize verifying exposure in MCP deployments with allowAdmin=true and non-root allowedUsers set, and apply the fix. The vulnerability allows authenticated read-only users to modify server GlobalConfiguration.

Defensive priority

Defenders should prioritize verifying exposure in MCP deployments with allowAdmin=true and non-root allowedUsers set, and apply the fix in version 26.8.1.

Recommended defensive actions

• Verify exposure in MCP deployments with allowAdmin=true and non-root allowedUsers set
• Apply the fix in version 26.8.1
• Monitor for potential configuration tampering or denial of service
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fix. However, additional information on potential exploitation or affected systems is limited. The vulnerability allows any authenticated read-only user to modify server GlobalConfiguration via the set_server_setting MCP server-level tool. The issue is fixed in version 26.8.1. Defenders should verify exposure in MCP deployments with allowAdmin=true and non-root allowedUsers set.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.