CVE-2026-68578 — ArcadeDB before 26.7.3 Authentication Bypass via MCP Transport
ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP…
Published: 2026-08-02 · CVSS: 7.7 · CVSS 4.0
ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via the query tool.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7