CVE-2026-68578: ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-al
ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via the query tool.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-68578
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-68578 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for ArcadeDB
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- highCVE-2026-67357: ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get…nvd · 2026-08-02
- highCVE-2026-67356: ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts wi…nvd · 2026-08-02
- mediumCVE-2026-67344: ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYP…nvd · 2026-08-01
- highCVE-2026-67343: ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/s…nvd · 2026-08-01
- criticalCVE-2026-67342: ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers…nvd · 2026-08-01
- criticalCVE-2026-67341: ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFI…nvd · 2026-08-01
More from NVD Recent CVEs
- mediumCVE-2026-68583: luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in t…2026-08-02
- mediumCVE-2026-68582: Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vul…2026-08-02
- highCVE-2026-68581: Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token managem…2026-08-02
- highCVE-2026-68580: FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection…2026-08-02
- criticalCVE-2026-68579: FreeRDP before 3.30.0 (<= 3.29.0) contains a heap-based buffer overflow in the Windows clipboa…2026-08-02