Vulnerability · Published Aug 18, 2026 · Assigned by VulnCheck
CVE-2026-75854ArcadeDB Redis Wire-Protocol Plugin Missing Authentication
Critical 9.8
In plain English
A critical-severity missing authentication in arcadedb from ArcadeData. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.9%top 40.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without providing credentials, bypassing all security gates.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ArcadeData | arcadedb | 0 – before 26.8.1 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- GitHub Security Advisory (GHSA-m46c-jh3x-xwrp) vendor-advisory
- VulnCheck Advisory: ArcadeDB Redis Wire-Protocol Plugin Missing Authentication third-party-advisory