CVE-2026-75845: ArcadeDB 26.4.2 before 26.8.1 Authorization Bypass via set_server_setting
ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the setserversetting MCP server-level tool. SetServerSettingTool.execute() gates only on the global allowAdmin flag and never checks the caller's role, so in an MCP deployment with allowAdmin=true and a non-root allowedUsers set, any authenticated read-only user can invoke setserversetting to modify server GlobalConfiguration, enabling configuration tampering or denial of service. The issue is fixed in 26.8.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ArcadeDBto a version that resolves this vulnerability.Fixed in 26.8.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The affected condition requires an MCP deployment where allowAdmin=true and allowedUsers includes non-root users. In that configuration, an authenticated read-only user can reach the server-level tool.
What access does an attacker need to exploit the bypass?
An attacker needs valid authentication as a read-only user permitted by the MCP deployment. No user interaction is required, because the tool checks allowAdmin but does not verify the caller's role.
What can be done to mitigate the issue before upgrading?
Upgrade to ArcadeDB 26.8.1, which fixes the issue. If upgrading cannot occur immediately, avoid the exposed configuration by disabling allowAdmin or ensuring allowedUsers does not include non-root users.
How can I determine whether my deployment is affected?
Review the MCP configuration for allowAdmin=true together with a non-root allowedUsers set, and determine whether users in that set can invoke set_server_setting. Affected versions are 26.4.2 through 26.7.3.