CVE-2026-75852 — ArcadeDB MongoDB wire protocol authentication bypass cross-database
ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, updat…
Published: 2026-08-18 · CVSS: 9.3 · CVSS 4.0
ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7