CVE-2026-75852 in ArcadeDB
Summary
by MITRE • 08/18/2026
ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/18/2026
ArcadeDB versions prior to 26.8.1 contain a critical authentication bypass vulnerability within its MongoDB wire-protocol plugin that allows unauthenticated access to the underlying data store. This flaw stems from an incomplete implementation of security controls, specifically where Simple Authentication and Security Layer (SASL) mechanisms are not properly enforced for standard database operations. When clients connect via port 27017 using the MongoDB protocol interface, the server fails to validate credentials before processing commands intended to manipulate data or schema structures. This misconfiguration effectively renders any authentication settings configured in ArcadeDB irrelevant for traffic arriving through this specific plugin endpoint, creating a significant security gap that undermines the principle of least privilege and proper access control mechanisms.
The technical nature of this vulnerability is classified as an authorization bypass resulting from improper enforcement of authentication protocols. Attackers can exploit this flaw by establishing a direct connection to port 27017 without providing any valid username or password credentials. Once connected, they are granted unrestricted ability to execute critical data manipulation commands including insert, find, update, and delete operations against any accessible database within the instance. Furthermore, attackers retain the capability to create new databases or collections, effectively allowing them to alter the schema structure of the application. This level of access is equivalent to having full administrative privileges over the entire dataset hosted by ArcadeDB, as there are no intermediate checks to verify if the connecting entity has been authorized for such actions.
The operational impact of this vulnerability is severe and potentially catastrophic depending on the sensitivity of the data stored within the affected databases. Unauthenticated attackers can exfiltrate sensitive information through find commands, leading to a complete compromise of confidentiality. They can also modify or destroy existing records via update and delete operations, resulting in significant integrity loss and potential denial of service conditions if critical data is corrupted or removed entirely. Additionally, the ability to create new entities allows for further persistence mechanisms or the injection of malicious payloads disguised as legitimate database entries. This vulnerability exposes organizations to risks including regulatory non-compliance due to unauthorized access to personal or financial records, reputational damage from publicized breaches, and direct financial losses associated with data recovery efforts and incident response activities.
From a classification perspective, this issue aligns closely with CWE-287 Improper Authentication, as the system fails to correctly verify identity before granting access. It also relates to CWE-862 Missing Authorization since authenticated users or unauthenticated actors are able to perform actions they should not be permitted to execute. In terms of adversary tactics, this vulnerability facilitates initial access and privilege escalation techniques documented in the MITRE ATT&CK framework, specifically allowing attackers to bypass authentication controls to gain a foothold within the network infrastructure. The exploitation does not require complex payloads or specific application logic errors but relies solely on protocol-level misconfiguration, making it easily exploitable by automated tools and low-skill threat actors scanning for open MongoDB-compatible ports without security protections.
To mitigate this vulnerability, organizations running ArcadeDB must immediately upgrade to version 26.8.1 or later where the SASL authentication enforcement has been corrected for all data commands within the MongoDB wire-protocol plugin. Until an update can be applied, network-level controls should be implemented to restrict access to port 27017 exclusively from trusted IP addresses using firewall rules or security groups. It is also advisable to disable the MongoDB protocol interface if it is not strictly required by existing applications, thereby eliminating the attack surface entirely. Regular vulnerability scanning and penetration testing focused on database ports can help identify similar misconfigurations in other systems. Security teams should audit their network architecture to ensure that no internal services are exposed directly to untrusted networks without proper authentication gateways or reverse proxies enforcing credential validation before traffic reaches the backend service.