CVE-2026-75845: falha de média gravidade em ArcadeData arcadedb
ArcadeDB 26.4.2 before 26.8.1 Authorization Bypass via set_server_setting
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.3%
ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the set_server_setting MCP server-level tool. SetServerSettingTool.execute() gates only on the global allowAdmin flag and never checks the caller's role, so in an MCP deployment with allowAdmin=true and a non-root allowedUsers set, any authenticated read-only user can invoke set_server_setting to modify server GlobalConfiguration, enabling configuration tampering or denial of service. The issue is fixed in 26.8.1.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Produtos afetados
ArcadeData · arcadedbCVEs relacionadas — ArcadeData arcadedb
No mesmo produto, das mais perigosas para as menos.
CVE-2026-67340HIGHArcadeDB before 26.7.2 Remote Code Execution via Trigger ScriptsEPSS 0.9%CVE-2026-75854CRITICALArcadeDB Redis Wire-Protocol Plugin Missing AuthenticationEPSS 0.9%CVE-2026-76224HIGHArcadeDB before 26.8.1 Remote Code Execution via Groovy FallbackEPSS 0.9%CVE-2026-75852CRITICALArcadeDB MongoDB wire protocol authentication bypass cross-databaseEPSS 0.7%CVE-2026-114059HIGHArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing AuthorizationEPSS 0.6%CVE-2026-93598HIGHArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundleEPSS 0.6%