ByteOS Network

CVE Vulnerability Details :

CVE-2026-68578

PUBLISHED

More Info Official Page

Assigner-VulnCheck

Assigner Org ID-83251b91-4cc7-4094-a5c7-464a1b83ea10

Published At-02 Aug, 2026 | 12:15

Updated At-02 Aug, 2026 | 12:19

▼CVE Numbering Authority (CNA)

ArcadeDB before 26.7.3 Authentication Bypass via MCP Transport

ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via the query tool.

Affected Products

Vendor

ArcadeData

Product

arcadedb

Default Status

unaffected

Versions

Affected

From 0 before 26.7.3 (semver)

Unaffected

26.7.3 (semver)

Problem Types

Type	CWE ID	Description
CWE	CWE-306	Missing Authentication for Critical Function

Type: CWE

CWE ID: CWE-306

Description: Missing Authentication for Critical Function

Metrics

Version	Base score	Base severity	Vector
4.0	7.7	HIGH	CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Version: 4.0

Base score: 7.7

Base severity: HIGH

Vector:

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Version: 3.1

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Credits

reporter

manus-use

References

Hyperlink	Resource
https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-6x73-v3rc-f57c	vendor-advisory
https://www.vulncheck.com/advisories/arcadedb-authentication-bypass-via-mcp-transport	third-party-advisory

Hyperlink: https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-6x73-v3rc-f57c

Resource:

vendor-advisory

Hyperlink: https://www.vulncheck.com/advisories/arcadedb-authentication-bypass-via-mcp-transport

Resource:

third-party-advisory

Affected Products

Affected

Unaffected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References