CVE-2026-67357: ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that leaks the arcadedb.ha.clusterToken in cleartext. Attackers
ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that leaks the arcadedb.ha.clusterToken in cleartext. Attackers with MCP access can retrieve the cluster token and use it with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate root and achieve full server compromise.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-67357
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-67357 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for ArcadeDB
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- highCVE-2026-68578: ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP trans…nvd · 2026-08-02
- highCVE-2026-67356: ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts wi…nvd · 2026-08-02
- mediumCVE-2026-67344: ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYP…nvd · 2026-08-01
- highCVE-2026-67343: ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/s…nvd · 2026-08-01
- criticalCVE-2026-67342: ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers…nvd · 2026-08-01
- criticalCVE-2026-67341: ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFI…nvd · 2026-08-01
More from NVD Recent CVEs
- criticalCVE-2026-65321: PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated at…2026-08-02
- lowCVE-2026-10774: Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-ke…2026-08-02
- mediumCVE-2026-68583: luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in t…2026-08-02
- mediumCVE-2026-68582: Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vul…2026-08-02
- highCVE-2026-68581: Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token managem…2026-08-02