CVE-2026-68578: ArcadeDB before 26.7.3 Authentication Bypass via MCP Transport
ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via the query tool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ArcadeDBto a version that resolves this vulnerability.Fixed in 26.7.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68578?
The severity of CVE-2026-68578 is high with a CVSS score of 7.5.
How do I fix CVE-2026-68578?
To fix CVE-2026-68578, upgrade ArcadeDB to version 26.7.3 or later.
What are the risks associated with CVE-2026-68578?
CVE-2026-68578 allows non-root users to perform arbitrary database writes, make schema mutations, and execute arbitrary JavaScript code.
Which versions of ArcadeDB are affected by CVE-2026-68578?
ArcadeDB versions prior to 26.7.3 are affected by CVE-2026-68578.
What impact does CVE-2026-68578 have on database security?
CVE-2026-68578 significantly compromises database security by allowing unauthorized actions that could lead to data breaches.