Vulnerability · Published Aug 2, 2026 · Assigned by VulnCheck
CVE-2026-68578ArcadeDB before 26.7.3 Authentication Bypass via MCP Transport
High 7.5
In plain English
A high-severity missing authentication in arcadedb from ArcadeData. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 69.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via the query tool.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ArcadeData | arcadedb | 0 – before 26.7.3 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- GitHub Security Advisory (GHSA-6x73-v3rc-f57c) vendor-advisory
- VulnCheck Advisory: ArcadeDB before 26.7.3 Authentication Bypass via MCP Transport third-party-advisory